WordPress Plugin Bold Page Builder Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-1157: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and...

PT-2024-19806 · Mattermost · Mattermost Jira Plugin

Name of the Vulnerable Software and Affected Versions: Mattermost Jira Plugin affected versions not specified Description: The Mattermost Jira Plugin fails to protect against logout CSRF, allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in...

CVE-2024-1118

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Sql injection

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-1118 Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-1118 Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.2) +170 more potentially affected by CVE-2024-24680 via django (>=3.2.0, <=3.2.23)

django PYPI version =3.2.0, =1.0.1a0, =0.0.1.dev1, =2.0.0, =0.0.1, =1.0.0, =3.2.17.0, =0.0.1, =6.2.0, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =22.0.0.dev11 and more Source cves: CVE-2024-24680 Source advisory: OSV:GHSA-XXJ9-F6RV-M3X4...

PT-2024-16803

Name of the Vulnerable Software and Affected Versions Podlove Subscribe button plugin for WordPress versions up to, and including, 1.3.10 Description The issue is related to a UNION-based SQL Injection vulnerability via the button attribute of the podlove-subscribe-button shortcode. This...

WordPress Plugin Podlove Subscribe button SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2024-1118: Improper Neutralization of Special Elements used in an SQL Command

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Podlove Subscribe button Plugin <= 1.3.10 is vulnerable to SQL Injection

Software Podlove Subscribe button Type Plugin Vulnerable versions = 1.3.10 Fixed in 1.3.11 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1118 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID fcca748172f2 Credits Lucio Sá Required privilege Contributor...

Cross site scripting

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including 9.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-7029

CVE-2023-7029 affects the WordPress MaxButtons plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in shortcode attributes due to insufficient input sanitization and output escaping, exploitable by authenticated users with contributor-level access and above. All versions up to 9.7.6 ...

WordPress plugin WordPress Button Plugin MaxButtons Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leadin...

xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leadin...

xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leadin...

RHEL 9 : tigervnc (RHSA-2024:0626)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0626 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

GLSA-202401-30 : X.Org X Server, XWayland: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-30 X.Org X Server, XWayland: Multiple Vulnerabilities - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap ...