CVE-2024-9932 Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-9931

CVE-2024-9931: Wux Blog Editor for WordPress contains an authentication bypass in versions

CVE-2024-9931 Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the fir...

PT-2024-39947

Name of the Vulnerable Software and Affected Versions Wux Blog Editor plugin for WordPress versions up to and including 3.0.0 Description The Wux Blog Editor plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the wuxbt insertImageNew...

CVE-2024-9932: Unrestricted Upload of File with Dangerous Type

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

PT-2024-39735 · WordPress · Editor Custom Color Palette

Name of the Vulnerable Software and Affected Versions: Editor Custom Color Palette plugin for WordPress versions up to, and including, 3.3.7 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access and above ...

WordPress plugin Wux Blog Editor code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Wux Blog Editor has a security vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39946

Name of the Vulnerable Software and Affected Versions Wux Blog Editor plugin for WordPress versions up to, and including, 3.0.0 Description The issue is related to authentication bypass due to missing validation on the token supplied during autologin through the plugin. This allows unauthenticate...

CVE-2024-9931: Authentication Bypass Using an Alternate Path or Channel

The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autologin through the plugin. This makes it possible for unauthenticated attackers to log in to the fir...

CVE-2024-9642: Improper Neutralization of Input During Web Page Generation

The Editor Custom Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

WordPress Editor Custom Color Palette plugin <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Editor Custom Color Palette versions = 3.3.7...

WordPress Wux Blog Editor plugin <= 3.0.0 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

WordPress Wux Blog Editor plugin <= 3.0.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

RLSA-2024:8327 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 For more details about the security issues, includi...

WordPress Wux Blog Editor Plugin <= 3.0.0 is vulnerable to Broken Authentication

Software Wux Blog Editor Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9931 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 140fce8f5a83 Credits István...

WordPress Editor Custom Color Palette Plugin <= 3.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Editor Custom Color Palette Type Plugin Vulnerable versions = 3.3.7 Fixed in 3.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9642 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d1e22897a97b Credits Francesco...

WordPress Wux Blog Editor Plugin <= 3.0.0 is vulnerable to Arbitrary File Upload

Software Wux Blog Editor Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9932 Patch priority High CVSS severity High 10 Developer Claim ownership PSID fb6562f2b82e Credits István Márton Required privilege...

CVE-2024-10313

iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or...

CVE-2024-10313 iniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal

iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or...