[SECURITY] Fedora 40 Update: editorconfig-0.12.7-1.fc40

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors...

[SECURITY] Fedora 38 Update: editorconfig-0.12.7-1.fc38

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors...

[SECURITY] Fedora 39 Update: editorconfig-0.12.7-1.fc39

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors...

CVE-2024-2344

The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted...

Super Socializer < 7.13.64 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC When creating a new widget, insert the following payload in the "FaceBook URL" field ...

PT-2024-2486 · Grav Cms · Grav Cms

Name of the Vulnerable Software and Affected Versions: Grav CMS versions prior to 1.7.45 Description: The issue is related to a Server-Side Template Injection SSTI in Grav CMS, which allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing th...

BIT-GHOST-2023-26510

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no...

CVE-2024-0699

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'addimagefromurl' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with...

CVE-2023-6373

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor or above...

PT-2024-14941 · WordPress · Artplacer Widget

Name of the Vulnerable Software and Affected Versions: ArtPlacer Widget WordPress plugin versions prior to 2.20.7 Description: The issue is related to the lack of sanitization and escaping of the id parameter before submitting a query, leading to a SQL injection SQLI that can be exploited by...

ArtPlacer Widget < 2.20.7 - Editor+ SQLi

Description The plugin does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor or above PoC As an editor, open...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud, related to reading data beyond the buffer in memory, allow attackers to gain access to confidential information.

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud involve reading data beyond the buffer in memory. Exploiting these vulnerabilities can allow attackers to access confidential information...

PYSEC-2023-219

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

PT-2023-29818 · Codedrafty · Codedrafty Mediabay – Media Library Folders

Name of the Vulnerable Software and Affected Versions: Codedrafty Mediabay – Media Library Folders plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher privileges. This...

The vulnerability of Microsoft Excel editors, related to insufficient protection of sensitive data, allows attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft Excel spreadsheet editors is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information by opening a specially created file...

Vulnerabilities fixed in FoxIT PDF Reader and PDF Editor

FoxIT has fixed vulnerabilities in PDF Reader and PDF Editor formerly PhantomPDF. A malicious person could exploit them to cause a denial-of-service, to execute arbitrary execute code with user privileges, or to access gain access to sensitive data in the context of the PDF software. Successful...

XWiki Platform 访问控制错误漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. XWiki Platform suffers from an Access Control Error vulnerability that stems from a security flaw in Groovy job checking. The vulnerability can be exploited by an attacker...

The vulnerability of Microsoft Excel editors arises from synchronization errors when using a shared resource, allowing an intruder to gain unauthorized access to the device.

The vulnerability of Microsoft Excel editors arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the device...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2020 are related to memory usage after it is released. This allows attackers to execute arbitrary code.

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020 is related to the use of memory after it is freed. Exploiting this...

Vulnerability fixed in Xwiki

The developers of Xwiki have fixed a vulnerability in the CKEditor of Xwiki. An authenticated malicious person with editing privileges in the CKeditor could exploit the vulnerability to modify arbitrary files in Xwiki, including those for which it is not authorized. This allows the malicious pers...