WordPress Metform Elementor Contact Form Builder Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0084 Patch priority High CVSS severity High 7.1 Developer Wpmet PSID 06d2857720ad Credits Mohammed ...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows a perpetrator to execute arbitrary code in the target system by having the user open a specially created...

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

The vulnerability of the 3D Builder software in designing and preparing objects for 3D printing arises from insufficient validation of input data. This allows a malicious actor to execute arbitrary code within the target system.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system by having the user open a specially created file...

PT-2023-14567 · Apollotheme · Wp Page Builder

Name of the Vulnerable Software and Affected Versions: ApolloTheme AP PageBuilder versions through 2.4.4 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show number parameter. Recommendations: For...

Rocky Linux 9 : Image Builder (RLSA-2022:7950)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7950 advisory. - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial o...

WordPress Greenshift – animation and page builder blocks Plugin < 5.0 is vulnerable to Cross Site Scripting (XSS)

Software Greenshift – animation and page builder blocks Type Plugin Vulnerable versions 5.0 Fixed in 5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0378 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b01a77788358...

VulnCheck KEV: CVE-2021-24205

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

ShopLentor < 2.5.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. As a contributor, add a "WL : FAQ" Gutenberg block to ...

ShopLentor < 2.5.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC As a contributor, add a "WL : FAQ" Gutenberg block...

Experts Uncover the Identity of Mastermind Behind Golden Chickens Malware Service

Cybersecurity researchers have discovered the real-world identity of the threat actor behind Golden Chickens malware-as-a-service, who goes by the online persona "badbullzvenom." eSentire's Threat Response Unit TRU, in an exhaustive report published following a 16-month-long investigation, said i...

GHSA-M6Q8-MWF6-6MMC CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin

A cross-site request forgery CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-W4V5-54P8-M4J5 Missing permission checks in Jenkins GitHub Pull Request Builder Plugin

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-CCF4-9HJC-XXC4 Jenkins GitHub Pull Request Builder Plugin missing permission check allows enumerating credentials IDs

Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credential...

CVE-2023-24436

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2023-24434

A cross-site request forgery CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...