CVE-2025-30860

CVE-2025-30860 is a DOM-based Cross-Site Scripting vulnerability in Off-Canvas Sidebars & Menus (Slidebars) for WordPress, stemming from improper neutralization of input during web page generation. Affected versions range up to 0.5.8.2 (date shown). Exploitation would require user interaction and...

PT-2025-13261

Name of the Vulnerable Software and Affected Versions gnuplot affected versions not specified Description A flaw was found in the CANVAS text function, which may lead to a segmentation fault and cause a system crash. Recommendations At the moment, there is no information about a newer version tha...

WordPress plugin Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

gnuplot 代码问题漏洞

gnuplot is a command-line interactive tool by Leon Sorokin, a personal developer, that allows users to enter commands to convert data and data functions into easily viewable flat or three-dimensional graphics. A code issue vulnerability exists in gnuplot, which stems from the CANVAStext function...

Linux Distros Unpatched Vulnerability : CVE-2024-43788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packagi...

WordPress Jeg Elementor Kit plugin <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Countdown and Off-Canvas vulnerability discovered by Ankit Patel in WordPress Plugin Jeg Elementor Kit versions = 2.6.11...

The vulnerability of the Responsive and off-canvas menu module in the Drupal CMS system, related to improper authentication, allows attackers to bypass security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Responsive and off-canvas menu module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.46.5 bsc1234851: Security fixes: CVE-2024-54479: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-54502: Processing maliciously crafted web content may lead to an unexpected...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.46.5 bsc1234851: Security fixes: CVE-2024-54479: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-54502: Processing maliciously crafted web content may lead to an unexpected...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in the Drupal Responsive and off-canvas menu prior to version 4.4.4, which stems from the inclusion of an authorization error vulnerability...

Fedora 41 : webkitgtk (2024-b142cc07d0)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b142cc07d0 advisory. Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent fi...

Important: qt5-qtcanvas3d

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

Fedora 39 : webkitgtk (2024-e1357fc22f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e1357fc22f advisory. Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent fi...

Fedora 40 : webkitgtk (2024-4c6304b6fa)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4c6304b6fa advisory. Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent fi...

DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS

Hi, Rspack|Webpack developer team! Summary We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an...

GHSA-84JW-G43V-8GJM DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS

Hi, Rspack|Webpack developer team! Summary We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an...

PT-2024-40181 · Webpack · Webpack

Name of the Vulnerable Software and Affected Versions: Webpack versions affected versions not specified Description: A DOM Clobbering vulnerability was discovered in Webpack's AutoPublicPathRuntimeModule, which can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled...

SUSE CVE-2024-43788

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack's...

GHSA-4VVJ-4CPR-P986 Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

Summary We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an unsanitized name attribute are...

Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

Summary We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an unsanitized name attribute are...