CVE-2024-4362 SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4362

CVE-2024-4362 affects SiteOrigin Widgets Bundle for WordPress. It is a Stored XSS via the plugin’s siteorigin_widget shortcode, in all versions up to and including 1.60.0, caused by insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability can be exploited...

CVE-2024-4362 SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

WordPress SiteOrigin Widgets Bundle plugin <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode vulnerability

WordPress SiteOrigin Widgets Bundle plugin = 1.60.0 - - Authenticated Contributor+ Stored Cross-Site Scripting via 'siteoriginwidget' Shortcode vulnerability discovered by stealthcopter in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.60.0...

WordPress SiteOrigin Widgets Bundle Plugin <= 1.60.0 is vulnerable to Cross Site Scripting (XSS)

Software SiteOrigin Widgets Bundle Type Plugin Vulnerable versions = 1.60.0 Fixed in 1.61.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4362 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9b62158e461e Credits stealthcopte...

CVE-2024-29651

A prototype pollution flaw was found in the API Dev Tools json-schema-ref-parser. This flaw allows a remote attacker to cause a denial of service, Cross-site scripting, or arbitrary code via the bundle, parse, resolve, and dereference functions. Mitigation Mitigation for this issue is either not...

scheb/two-factor-bundle bypass two-factor authentication with remember-me option

In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...

scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...

GHSA-H6MP-MC7G-MG49 scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...

PT-2024-40226 · Unknown · Scheb/Two-Factor-Bundle

Name of the Vulnerable Software and Affected Versions: scheb/two-factor-bundle versions prior to 3.26.0 scheb/two-factor-bundle versions prior to 4.11.0 Description: A security issue allowed attackers to bypass two-factor authentication 2FA using the remember me cookie. When the remember me...

json-schema-ref-parser Prototype Pollution issue

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle, parse, resolve, dereference functions...

GHSA-5F97-H2C2-826Q json-schema-ref-parser Prototype Pollution issue

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle, parse, resolve, dereference functions...

CVE-2024-29651

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle, parse, resolve, dereference functions...

CVE-2024-29651

CVE-2024-29651 is a Prototype Pollution vulnerability in API Dev Tools json-schema-ref-parser (versions 11.0.0 and 11.1.0). The flaw allows remote code execution or denial of service by manipulating Object.prototype via bundle(), parse(), resolve(), or dereference() functions. Affected IBM stack ...

Session Hijacking

friendsofsymfony/user-bundle is vulnerable to session hijacking. The vulnerability is due to inadequate session management, which could allow an attacker to take over a users session...

Authentication Bypass

friendsofsymfony/user-bundle is vulnerable to Authentication Bypass. The vulnerability is due to an insecure user refresh implementation due to using the primary key instead of the username, which can result in authentication bypass if users are allowed to change usernames...

Cross Site Scripting (XSS)

friendsofsymfony/rest-bundle is vulnerable to Cross Site Scripting XSS. The vulnerability is due to incorrect jsonp validation due to sanitizing the callback query param name rather than its value, which allows potentially malicious callback values to be processed, leading to Cross Site Scriping...

PT-2024-40444 · Nzo · Nzo/Url-Encryptor-Bundle

Name of the Vulnerable Software and Affected Versions: nzo/url-encryptor-bundle versions prior to 5.0.1 nzo/url-encryptor-bundle versions prior to 4.3.2 Description: The issue is related to the lack of mandatory key and IV requirements in the affected versions. By default, the bundle uses the...

gnutls: potential crash during chain building/verification

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...

endroid/qr-code-bundle File Disclosure via logo_path query parameter

Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logopath query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure...