WordPress ShortPixel Image Optimizer Plugin <= 5.6.3 is vulnerable to SQL Injection

Software ShortPixel Image Optimizer Type Plugin Vulnerable versions = 5.6.3 Fixed in 5.6.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-48043 Patch priority Low CVSS severity Low 7.6 Developer ShortPixel PSID d284fe203395 Credits Rafie Muhammad Patchstack Required privileg...

CVE-2024-7489 Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters

The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-7489: Improper Neutralization of Input During Web Page Generation

The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for...

PDF-XChange Editor JPG File Parsing Out-of-Bounds Read Remote Code Execution Vulnerability

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An out-of-bounds read remote code execution vulnerability exists in PDF-XChange Editor JPG file parsing, which can be exploited by an attacker to execute code in the context of the...

PDF-XChange Editor EMF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor EMF file parsing there are out-of-bounds read information leakage vulnerability, an attacker can exploit the vulnerability to obtain sensitive information...

CVE-2024-9234: Missing Authorization

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the installandactivatepluginfromexternal function install-active-plugin REST API endpoint in all versions up to,...

WordPress UserPlus plugin <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation vulnerability

Authenticated Editor+ Registration Form Update to Privilege Escalation vulnerability discovered by István Márton in WordPress Plugin UserPlus versions = 2.0...

Malicious code in prismjs-editor-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 040f9d206fa46c86f67191c2a1777918670867a6e0888635b2f08567360ba10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9244 Malicious code in prismjs-editor-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 040f9d206fa46c86f67191c2a1777918670867a6e0888635b2f08567360ba10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in prismjs-editor-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-9519

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'savemetaboxform' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update t...

CVE-2024-9519 UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'savemetaboxform' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update t...

SUSE CVE-2024-47814

Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2024-2570)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. double-free in dialogchanged in Vim v9.1.0648. When abandoning a buffer, Vim may ask the user what to...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2024-2596)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. double-free in dialogchanged in Vim v9.1.0648. When abandoning a buffer, Vim may ask the user what to...

Vim 9.1.0764 (GHSA-rj48-v4mq-j4vg)

The version of Vim installed on the remote host is prior to 9.1.0764. It is, therefore, affected by a vulnerability as referenced in the GHSA-rj48-v4mq-j4vg advisory. - Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a...

WordPress Smart Post Show plugin <= 3.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Pagination Color vulnerability

Authenticated Editor+ Stored Cross-Site Scripting via Pagination Color vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions = 3.0.0...

October 8, 2024—KB5044288 (OS Build 25398.1189)

None None...

PT-2024-6728 · Microsoft · Office Visio

Name of the Vulnerable Software and Affected Versions: Microsoft Office Visio affected versions not specified Description: The issue is related to a lack of warning about dangerous actions in the Microsoft Office Visio graphic editor, which is part of Microsoft Office and Microsoft 365 Apps for...

AZL-50138 CVE-2024-47814 affecting package vim for versions less than 9.1.0791-1

Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user...