StringBuilder for Node.js Security Vulnerability

StringBuilder for Node.js is a simple and fast in-memory string generator for Node.js by Magic Len Personal Developer. A security vulnerability exists in StringBuilder for Node.js, which stems from an incorrect calculation of the memory length and is susceptible to out-of-bounds reads, which can...

WordPress WPBITS Addons For Elementor Page Builder Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software WPBITS Addons For Elementor Page Builder Type Plugin Vulnerable versions = 1.5 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37945 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6f6499d9aa17 Credits Michael Require...

WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin <= 1.8.3 is vulnerable to Broken Access Control

Software iPanorama 360 WordPress Virtual Tour Builder Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38690 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 070f425a0f60 Credits...

WordPress Tabs For WPBakery Page Builder plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Tabs For WPBakery Page Builder versions = 1.2...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...

CVE-2024-37520

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through = 2.1.12...

CVE-2024-37520

CVE-2024-37520 describes a path traversal (local file inclusion) vulnerability in the ShopBuilder – Elementor WooCommerce Builder Addons WordPress plugin. The flaw affects ShopBuilder versions n/a through 2.1.12 and is listed as an authenticated (Contributor+) issue with LFI via improper pathname...

CVE-2024-37464

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5...

CVE-2024-37464

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5...

CVE-2024-37464 WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.5 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5...

CVE-2024-37464

CVE-2024-37464 corresponds to an authenticated Local File Inclusion (path traversal) in Beaver Builder Addons by WPZOOM. Public sources in Connected Documents report that affected software is Beaver Builder Addons by WPZOOM, with versions from n/a through 1.3.5, and that the issue enables local f...

CVE-2024-37464 WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.5 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5...

CVE-2024-4862

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-37437

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Elementor Elementor Website Builder allows Cross-Site Scripting XSS, Stored XSS.This issue affects Elementor Website Builder: from n/a through 3.22.1...

CVE-2024-37410

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Beaver Addons PowerPack Lite for Beaver Builder allows Path Traversal.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.0.3...

CVE-2024-4862 WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4862

CVE-2024-4862 affects the WPBITS Addons For Elementor Page Builder for WordPress. The Red Hat entry confirms a Stored Cross-Site Scripting vulnerability in multiple widgets caused by insufficient input sanitization and output escaping for user-supplied attributes, exploitable by authenticated att...

WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin WPBITS Addons For Elementor Page Builder versions = 1.5...