CVE-2024-4334

CVE-2024-4334 affects Supreme Modules Lite for Divi (WordPress) via DOM-Based XSS in the typing_cursor parameter up to and including version 2.5.3 due to insufficient input sanitization/output escaping. Exploitation requires authenticated access at contributor level or higher, targeting pages loa...

CVE-2024-4334 Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting

The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the ‘typingcursor’ parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-4334 Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting

The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the ‘typingcursor’ parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Supreme Modules Lite plugin <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Supreme Modules Lite versions = 2.5.3...

Elementor Website Builder Pro < 3.21.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

Description The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

WordPress Getwid – Gutenberg Blocks plugin <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via 'Countdown' vulnerability discovered by Webbernaut in WordPress Plugin Getwid versions = 2.0.7...

CVE-2024-33648

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kemory Grubb Recencio Book Reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through 1.66.0...

RHEL 6 / 7 / 8 : Red Hat AMQ Interconnect 1.9.0 (RHSA-2020:4211)

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4211 advisory. Red Hat AMQ Interconnect is a component of the AMQ 7 product family. AMQ Interconnect provides flexible routing of messages between...

HTML attributes vs DOM properties

Attributes and properties are fundamentally different things. You can have an attribute and property of the same name set to different values. For example: … const div = document.querySelector'divfoo=bar'; console.logdiv.getAttribute'foo'; // 'bar' console.logdiv.foo; // undefined div.foo = 'hell...

HTML attributes vs DOM properties

Attributes and properties are fundamentally different things. You can have an attribute and property of the same name set to different values. For example: … const div = document.querySelector'divfoo=bar'; console.logdiv.getAttribute'foo'; // 'bar' console.logdiv.foo; // undefined div.foo = 'hell...

@conform-to/react (>=1.0.0-pre.0, <=1.1.0), @conform-to/zod (>=1.0.0-pre.3, <=1.1.0) potentially affected by CVE-2024-32866 via @conform-to/dom (>=1.0.0, <=1.1.0-pre.0)

@conform-to/dom NPM version =1.0.0, =1.0.0-pre.0, =1.0.0-pre.3, =1.1.0 Source cves: CVE-2024-32866 Source advisory: OSV:GHSA-624G-8QJG-8QXF...

@conform-to/react (>=0.1.0, <=0.9.1), @kentcdodds/workshop-app (>=1.41.0, <=1.46.7) +1 more potentially affected by CVE-2024-32866 via @conform-to/dom (>=0.1.0, <=0.9.1)

@conform-to/dom NPM version =0.1.0, =0.1.0, =1.41.0, =3.0.0-beta1, =3.0.0-beta4 Source cves: CVE-2024-32866 Source advisory: OSV:GHSA-624G-8QJG-8QXF...

OESA-2024-1475 apache-mime4j security update

Java stream based MIME message parser. Security Fixes: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. CVE-2024-21742...

OESA-2024-1476 apache-mime4j security update

Java stream based MIME message parser. Security Fixes: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. CVE-2024-21742...

OESA-2024-1478 apache-mime4j security update

Java stream based MIME message parser. Security Fixes: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. CVE-2024-21742...

Cross-site Scripting (XSS)

github.com/tiagorlampert/chaos is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the sendCommandHandler function accepting unsanitized input via the output parameter and passing it along to the DOM, which results in a payload being executed by a user sending a request to the...

CVE-2024-2666

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-2666

CVE-2024-2666 affects the Premium Addons for Elementor plugin for WordPress. The Red Hat and initial CVE records describe a DOM-Based Stored Cross-Site Scripting vulnerability in the plugin’s Bullet List Widget, present in all versions up to and including 4.10.24. The issue stems from insufficien...

CVE-2024-2666 Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-2666 Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...