CVE-2024-32542

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

CVE-2024-32542

CVE-2024-32542 affects Bulk Block Converter (WordPress). Root cause: improper input neutralization during web page generation, enabling reflected XSS. Affected versions: from n/a through 1.0.1. Remediation: patch status listed as Unpatched in the provided docs.

CVE-2024-32542 WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

CVE-2024-32542 WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

WordPress Otter - Gutenberg Block Plugin <= 2.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Otter - Gutenberg Block Type Plugin Vulnerable versions = 2.6.9 Fixed in 2.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3725 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4871e8fce1d7 Credits Ngô Thiên An...

PT-2024-21528

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A warning in copy from iter has been reported by Syzkaller due to an iov iter being used in the wrong direction. This occurs when a request with a transfer direction of SG DXFER TO FROM...

CVE-2024-31582

FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the drawblockrectangle function of libavfilter/vfcodecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service DoS via crafted input...

PT-2024-21572 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A data race issue has been identified in the Linux kernel, specifically in the btrfs module. The issue occurs when accessing the reserved amount of block reserves without taking the...

PT-2024-24662 · Organic Themes · Organic Themes Bulk Block Converter

Name of the Vulnerable Software and Affected Versions: Organic Themes Bulk Block Converter versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means that an...

USN-6726-2: Linux kernel (IoT) vulnerabilities

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service host domain crash...

USN-6725-2 linux-aws, linux-aws-5.15 vulnerabilities

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service system crash or possibly...

WordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Gutenberg Block Editor Toolkit versions = 1.40.4...

CVE-2024-3029

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...

CVE-2024-3029 Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

CVE-2024-3029 Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

CVE-2024-3029

The CVE-2024-3029 issue affects mintplex-labs/anything-llm. A malformed JSON payload to /system/enable-multi-user triggers an error caught by a catch block that deletes all users and disables multi_user_mode, potentially allowing an attacker to remove existing users and create a new admin without...

CVE-2024-3029 Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

WordPress Gutenberg Block Editor Toolkit Plugin <= 1.40.4 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Block Editor Toolkit Type Plugin Vulnerable versions = 1.40.4 Fixed in 1.40.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32586 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a7cac184918b Credits Steven Julian Require...

Extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". No bundled extension is vulnerable. Vulnerable uses do appear in a documentation example and in non-bundled extensions. Hence, the attack prerequisite is ...