CVE-2024-9614 Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting

The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2024-39719 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: Constant Contact Forms by MailMunch plugin for WordPress versions up to, and including, 2.1.2 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitra...

WordPress plugin Constant Contact Forms by MailMunch 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugin Constant Contact...

WordPress Constant Contact Forms by MailMunch plugin <= 2.1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Constant Contact Forms by MailMunch versions = 2.1.2...

kernel: cifs: fix mid leak during reconnection after timeout threshold

In the Linux kernel, the following vulnerability has been resolved: cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUSIOTIMEOUT exceeds a specified threshold NUMSTATUSIOTIMEOUT, we reconnect the connection. But we do not return the mi...

WordPress Constant Contact Forms by MailMunch Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Constant Contact Forms by MailMunch Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9614 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 53dd5edc8197 Credits...

CVE-2024-50198 iio: light: veml6030: fix IIO device retrieval from embedded device

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that is received as an argument in the inilluminanceperiodavailableshow function references the device embedded in the IIO device, not in the i2c...

PT-2024-38028 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.17.1 Description: The issue is a Timing Attack, a type of side-channel attack that allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. In the context of...

SUSE CVE-2024-47869

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

PYSEC-2024-199

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

PYSEC-2024-199

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

CVE-2024-47869

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

CVE-2024-47869

Summary (CVE-2024-47869): Gradio (Python) contains a timing-attack vulnerability in the analytics_dashboard hash comparison that is not performed in constant time. An attacker could infer the correct hash byte-by-byte by measuring response times, potentially gaining unauthorized access to the ana...

CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

Gradio performs a non-constant-time comparison when comparing hashes

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of differen...

GHSA-J757-PF57-F8R4 Gradio performs a non-constant-time comparison when comparing hashes

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of differen...

Gradio 安全漏洞

Gradio, an open source Python library open-sourced by Hugging Face, is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a security vulnerability that stems from the fact that comparisons are not done in constant time, which can be exploited by an...

PT-2024-19601 · Unknown · Openslides

Name of the Vulnerable Software and Affected Versions: OpenSlides version 4.0.15 Description: The issue allows attackers to obtain information about the password hash using a timing attack, as the password verification function in OpenSlides has content-dependent runtime. This means the function...