Widget Bundle <= 2.0.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Enable the "Text Form" widget...

Widget Bundle <= 2.0.0 - Unauthencated Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users PoC On a site with the User Login/Registration widget active, have an unauthenticated user send...

CVE-2024-1723

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.58.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor acce...

Fedora: Security Advisory for maven-bundle-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: maven-bundle-plugin-5.1.9-5.fc40

Provides a maven plugin that supports creating an OSGi bundle from the contents of the compilation classpath along with its resources and dependencies. Plus a zillion other features...

CVE-2023-47821 WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jannis Thuemmig Email Encoder plugin = 2.1.8 versions...

com.agilejava.docbkx:docbkx-maven-base (>=2.0.6, <=2.0.17), com.agilejava.docbkx:docbkx-maven-plugin (>=2.0.6, <=2.0.17) +21 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.0-alpha-5)

org.codehaus.plexus:plexus-archiver MAVEN version 1.0-alpha-5 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.agilejava.docbkx:docbkx-maven-base =2.0.6, =2.0.6, =1.0-alpha-4, =1.0-alpha-4,...

com.zaxxer:nuprocess (>=0.9.0, <=0.9.4), com.zaxxer:sansorm (1.0) +47 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.7)

org.apache.maven:maven-core MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.zaxxer:nuprocess =0.9.0, =2.0, =1.1.0.beta5, =2.3.5, =2.2.5, =2.2.5, =1.0-beta-1, =2.1m1, =2.1m1,...

XML External Entity (XXE)

maven-bundle-plugin is vulnerable to XML external entity XXE attacks. The external DTDs is not disabled by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server or read system files...