CVE-2024-9642

The CVE-2024-9642 entry documents a Stored Cross-Site Scripting (XSS) flaw in the WordPress plugin Editor Custom Color Palette. The vulnerability allows authenticated users with Author-level access or higher to upload SVG files that bypass input sanitization and output escaping, enabling arbitrar...

CVE-2024-9931

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the fir...

CVE-2024-9932

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9932

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

[SECURITY] Fedora 41 Update: python-fastapi-0.115.2-1.fc41

FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.8+ based on standard Python type hints. The key features are: =E2=80=A2 Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python frameworks available...

CVE-2024-9932 Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9932 Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9932

CVE-2024-9932 affects the WordPress plugin “Wux Blog Editor” up to version 3.0.0. The root cause is inadequate file type validation in the wuxbt_insertImageNew function, enabling unauthenticated users to upload arbitrary files to the server and potentially achieve remote code execution. Publicly ...

CVE-2024-9931

CVE-2024-9931: Wux Blog Editor for WordPress contains an authentication bypass in versions

CVE-2024-9931 Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the fir...

PT-2024-39947

Name of the Vulnerable Software and Affected Versions Wux Blog Editor plugin for WordPress versions up to and including 3.0.0 Description The Wux Blog Editor plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the wuxbt insertImageNew...

PT-2024-39735 · WordPress · Editor Custom Color Palette

Name of the Vulnerable Software and Affected Versions: Editor Custom Color Palette plugin for WordPress versions up to, and including, 3.3.7 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access and above ...

WordPress plugin Wux Blog Editor 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Wux Blog Editor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39946

Name of the Vulnerable Software and Affected Versions Wux Blog Editor plugin for WordPress versions up to, and including, 3.0.0 Description The issue is related to authentication bypass due to missing validation on the token supplied during autologin through the plugin. This allows unauthenticate...

WordPress Editor Custom Color Palette plugin <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Editor Custom Color Palette versions = 3.3.7...

WordPress Wux Blog Editor plugin <= 3.0.0 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

WordPress Wux Blog Editor plugin <= 3.0.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

RLSA-2024:8327 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 For more details about the security issues, includi...

WordPress Wux Blog Editor Plugin <= 3.0.0 is vulnerable to Arbitrary File Upload

Software Wux Blog Editor Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9932 Patch priority High CVSS severity High 10 Developer Claim ownership PSID fb6562f2b82e Credits István Márton Required privilege...