WordPress Page Builder: Live Composer Plugin <= 1.5.35 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.35 Fixed in 1.5.36 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31933 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c287b96c4dbe Credits Brand...

The vulnerability of the OSBuild Composer service, related to improper verification of the cryptographic signature, allows a hacker to execute a “man-in-the-middle” attack.

The vulnerability of the OSBuild Composer service for creating system load images is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a attacker to execute a “man-in-the-middle” attack...

CVE-2024-30450 WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Step-Byte-Service GmbH OpenStreetMap for Gutenberg and WPBakery Page Builder formerly Visual Composer allows Stored XSS.This issue affects OpenStreetMap for Gutenberg and WPBakery Page Builder...

ROS-20240329-03

Vulnerability in InstalledVersions.php and install.php scripts of dependency manager for PHP Composer is related to the inclusion of functions from an invalid controlled scope. with the inclusion of functions from an invalid controlled scope. Exploitation of the vulnerability could allow an...

WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software OpenStreetMap for Gutenberg and WPBakery Page Builder formerly Visual Composer Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30450 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership...

Debian: Security Advisory (DLA-3777-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3777-1] composer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3777-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès March 27, 2024 https://wiki.debian.org/LTS -...

DLA-3777-1 composer - security update

Bulletin has no description...

Debian dla-3777 : composer - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3777 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3777-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-2725

CVE-2024-2725 affects the CIGESv2 system and describes an information-exposure vulnerability where a remote attacker can access the /vendor/composer/installed.json endpoint to enumerate all installed packages used by the application. Documented impact is information disclosure with CVSS v3.1 base...

osbuild-composer < 94 Race Condition

The version of osbuild-composer installed on the remote host is prior to 94. It may, therefore, be affected by a race condition. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted...

Visual Composer Website Builder < 45.7.0 - Authenticated (Editor+) Stored Cross-Site Scripting

Description The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 45.6.0 due to insufficient input sanitization and...

CVE-2024-2307

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built...

CVE-2024-27997

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997 WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997 WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997

CVE-2024-27997 is a stored cross-site scripting vulnerability in Visual Composer Website Builder. The initial and connected documents indicate the flaw stems from improper input neutralization during web page generation, allowing stored XSS. Affected software is Visual Composer Website Builder, w...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition that leads to disabling GPG verification for package repositories. This vulnerability exposes the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built. Remediation...

CVE-2024-2307 Osbuild-composer: race condition may disable gpg verification for package repositories

A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built...

CVE-2024-2307

CVE-2024-2307 affects osbuild-composer; a race/condition can disable GPG verification for package repositories during image build, enabling a MITM and potentially untrusted code in the built image. Documented across MiracleLinux, Alibaba Cloud Linux, TencentOS, Rocky Linux, and others; no patched...