WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.126...

Cross Site Scripting

rails-html-sanitizer, is vulnerable to Cross-Site Scripting. The vulnerability is due to improper handling of certain HTML5 elements when the sanitizer's allowed tags include "math", "mtext", "table", "style", and either "mglyph" or "malignmark." Attackers can exploit this by injecting malicious...

CVE-2024-10784 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-10784

CVE-2024-10784 affects Unlimited Elements For Elementor (WordPress) with a Stored XSS in the Tile Gallery widget. Attack requires authentication at Contributor level or higher and can yield arbitrary script execution on pages viewed by users, via insufficient input sanitization and output escapin...

PT-2024-16543 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.126 Description: The issue is related to Stored Cross-Site Scripting via the Tile Gallery widget due to insufficient input sanitization and output...

CVE-2024-10784: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2024-47834 GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a dat...

CVE-2024-47834

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a dat...

CVE-2024-47834

GStreamer: CVE-2024-47834 is a Use-After-Free read in the Matroska CodecPrivate handling within gst_matroska_demux_parse_stream. Specifically, a data chunk is allocated via gst_ebml_read_binary, later freed in gst_matroska_track_free (track-&gt;codec_priv), and then accessed in caps_serialize by ...

The vulnerability of the Now Platform IT infrastructure management system, related to the failure to take measures to neutralize specific elements of web pages, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Now Platform IT infrastructure management system is related to the failure to take measures to neutralize specific elements of web pages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the module that summarizes the Workflow framework for scanning vulnerabilities in Osmedeus, allowing attackers to perform cross-site scripting attacks

The vulnerability of the Workflow framework’s module summary component is related to the failure to remove specific elements from web pages when generating reports based on the general-template.md template. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting...

CVE-2023-51362: Missing Authorization

Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through = 2.1.3...

PT-2024-14090 · Premio · All-In-One Floating Contact Form – My Sticky Elements

Name of the Vulnerable Software and Affected Versions: All-in-one Floating Contact Form – My Sticky Elements versions 2.1.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This...

WordPress plugin Revy 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Eryaz NatraCar B2B Dealer Management Program 安全漏洞

Eryaz NatraCar B2B Dealer Management Program is a dealer management system from Eryaz. A security vulnerability exists in Eryaz NatraCar B2B Dealer Management Program that stems from improper use of special elements in SQL commands, resulting in a SQL injection vulnerability...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the QuTS operating systems and QTS network devices involves the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2024-16468 · WordPress · Powerpack Addons For Elementor

Name of the Vulnerable Software and Affected Versions: PowerPack Elementor Addons plugin for WordPress versions up to, and including, 2.8.1 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password protected, private, or draft post...

The vulnerability of the IBM Security Verify Access access control system lies in its lack of measures to neutralize special elements, allowing attackers to execute arbitrary code.

The vulnerability of the IBM Security Verify Access access control system lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability in the implementation of the SSH network protocol for the microprogramming-based software of industrial routers such as Billion M100, Billion M150, Billion M120N, and Billion M500 allows a hacker to execute arbitrary commands.

The vulnerability of the SSH network protocol implementation in the microprogramming-based software for industrial routers such as Billion M100, Billion M150, Billion M120N, and Billion M500 is related to the lack of measures to neutralize special elements used in operating system commands...