WordPress Internal Links Manager plugin <= 2.1.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities found by Chevon Phillip in WordPress Internal Links Manager plugin versions = 2.1.0. Solution 2020-12-28 - we were unable to find a patched version of this plugin. Notification from WordPress.org - "This plugin has been closed...

Automattic: Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php

Hey there, I have found a reflected dom xss vulnerability in your website www.intensedebate.com, the posttitle parameter is vulnerable. --------------------------------------------------------------------------------------------------------------------------------------------------- Full url:...

Security update for tmux (moderate)

openSUSE Security Update: Security update for tmux Announcement ID: openSUSE-SU-2020:1834-1 Rating: moderate References: 1037468 1116887 1120170 1178263 Cross-References: CVE-2018-19387 CVE-2020-27347 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE...

Basecamp: User can upload files even after closing his account

Summary: =========================== Hello @basecamp This is my first report on your program and I hope to end well : . I was testing https://app.hey.com/ and I my account has been closed, so I back to the requests history, and I tried to send these requests even my account closed. and I found th...

RUSTSEC-2020-0059 MutexGuard::map can cause a data race in safe code

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U. This could of led to data races in safe Rust code when a closure used in MutexGuard::map returns U that is unrelated to T. The issue was...

@dorfjungs/google-closure-extlib (>=1.0.0 <=1.1.17), @microduino/accountcenter (>=1.8.1 <=1.8.7) +31 more potentially affected by unknown CVE via google-closure-library (>=20151015.0.0 <=20190121.0.0)

google-closure-library NPM version =20151015.0.0, =1.0.0, =1.8.1, =0.1.0, =0.5.0, =2.0.0, =900.1.12, =1.0.0, =0.0.0, =1.0.1, =0.9.0, =0.9.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R9Q4-W3FM-WRM2...

Cross-Site Scripting in google-closure-library

Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting. Recommendation...

GHSA-R9Q4-W3FM-WRM2 Cross-Site Scripting in google-closure-library

Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting. Recommendation...

WordPress Elegant Testimonial plugin <= 1.1.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities found by Melbin K Mathew in WordPress Elegant Testimonial plugin versions = 1.1.6. Solution 2021-01-06 - we were unable to find a patched version of this plugin. WordPress.org notification - "This plugin has been closed as of...

jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts

A sandbox bypass flaw was found in the Jenkins Script Security Plugin versions 1.67 and earlier, that are related to the handling of closure default parameter expressions. This flaw allows attackers to execute arbitrary code in sandboxed scripts...

Claire's Customers Targeted with Magecart Payment-Card Skimmer

A Magecart credit-card skimmer was used to attack online customers of the retailer Claire’s for a month and a half, according to researchers. Claire’s – a purveyor of jewelry and accessories – closed its 3,000 physical retail locations worldwide on March 20, in the wake of the COVID-19 pandemic. ...

Insecure URL Parsing

google-closure-library does not properly parse URLs. An attacker is able to send a malicious URL to cause the server to return the wrong authority...

Google Closure Library Input Validation Error Vulnerability

Google Closure Library is the United States Google Google a cross-browser , modular JavaScript library . A security vulnerability exists in the goog.uri file in Google Closure Library v20200224 and earlier versions. An attacker can exploit this vulnerability by sending malicious URLs to obtain...

CVE-2020-8910

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

CVE-2020-8910

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

UBUNTU-CVE-2020-8910

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

Design/Logic Flaw

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

CVE-2020-8910

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

CVE-2020-8910 Auth Bypass in Google's Closure-Library

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315...

CVE-2020-8910

The CVE-2020-8910 entry concerns Google Closure Library’s goog.uri in versions up to v20200224. A URL-parsing flaw allows a crafted URL to yield an incorrect authority, potentially enabling bypass of host restrictions. Mitigation is to upgrade to version v20200315. Connected Nessus entry mirrors ...