Malicious code in sap-attributes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52b26a900c515b075888801513009f0e9cb0cdef2ac5acee26535ad9915aced9 The OpenSSF Package Analysis project identified 'sap-attributes' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7642 Malicious code in sap-attributes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52b26a900c515b075888801513009f0e9cb0cdef2ac5acee26535ad9915aced9 The OpenSSF Package Analysis project identified 'sap-attributes' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

WordPress plugin Bible Text security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, WordPress is a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin...

PT-2024-36330 · WordPress · Bible Text Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Bible Text WordPress plugin versions 0.2 and earlier Description: The issue is related to the lack of validation and escaping of some shortcode attributes in the plugin, which could allow users with the contributor role and above to perfo...

CVE-2024-4866

CVE-2024-4866 affects the UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS, Woo Widget, Menu Builder, Anywhere Elementor Shortcode) for WordPress. According to Red Hat and Wordfence data, all versions up to 1.1.6 are vulnerable to a Stored Cross-Site Scripting condit...

IBM Security QRadar Security Vulnerabilities

IBM Security QRadar is a modernized threat detection and response solution from International Business Machines IBM, Inc. designed to unify and integrate the security analyst experience and improve their response speed throughout the incident lifecycle. A security vulnerability exists in IBM...

The vulnerability of the RoundCube Webmail email client stems from insufficient protection of the website’s structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the RoundCube Webmail email client is related to insufficient protection of the website’s structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using SVG element animation attributes...

CVE-2024-4862

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3603 OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

WordPress Genesis Blocks plugin <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Sharing Block Attributes vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Genesis Blocks versions = 3.1.3...

CVE-2024-5881

CVE-2024-5881 affects the Webico Slider Flatsome Addons plugin for WordPress. It enables a Stored Cross-Site Scripting (XSS) flaw in the plugin’s wbc_image shortcode due to insufficient input sanitization and output escaping. The vulnerability impacts all versions up to and including 2.0.1 . Expl...

Cross-Site Scripting (XSS)

railsadmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improperly-escaped HTML title attributes in the RailsAdmin list view, which can allow attackers to inject malicious scripts. Note: While 3.1.3 is the safe version, its recommended to upgrade to 3.1.4 as the 3.1.3...

Cross Site Scripting (XSS)

zendframework/zend-form is vulnerable to Cross Site Scripting XSS. The vulnerability is due to the use of the escapeHtml helper instead of escapeHtmlAttr, leading to improper escaping of HTML attributes. An attacker can exploit this by injecting malicious code through user data or JavaScript in...

CVE-2024-2926

The CVE-2024-2926 entry concerns the Elementor Addons by Livemesh WordPress plugin (versions up to and including 8.3.7). A Stored Cross-Site Scripting (XSS) vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s widgets. Exploit...

CVE-2024-3638

CVE-2024-3638 affects Elementor Addons by Livemesh (WordPress). Stored XSS via Marquee Text, Testimonials, and Testimonial Slider widgets in all versions

PT-2024-22841 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets, allowing...

CVE-2024-6340

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CBL Mariner 2.0 Security Update: kernel (CVE-2020-27815)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-27815 advisory. - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the abili...

jinja2: accepts keys containing non-attribute characters

A flaw was found in jinja2. The xmlattr filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as opposed to only values as user input, and...

CVE-2024-39305 Envoy Proxy use after free when route hash policy is configured with cookie attributes

Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be...