Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar Vulnerability Details CVEID:CVE-2024-23672 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete cleanup flaw. By sending specially crafted...

CVE-2024-32775

Server-Side Request Forgery SSRF vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9...

CVE-2024-32775 WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9...

PT-2024-24847 · Unknown · Pavex Embed Google Photos Album

Name of the Vulnerable Software and Affected Versions: Pavex Embed Google Photos album versions n/a through 2.1.9 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, leading to vario...

Debian dsa-5667 : libtomcat9-embed-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5667 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82...

Debian dsa-5665 : libtomcat10-embed-java - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5665 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82...

GHSA-M64Q-4JQH-F72F Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Summary A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. Poc Inserting an embed with the below url can be copy/pasted onto canvas to insert as embed will log 42 to the console:...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

@fabric-foundation/sdk (>=0.0.65 <=1.0.2-beta.6), @frakt-protocol/frakt-sdk (>=0.0.7 <=0.0.9) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (=1.34.0)

@solana/web3.js NPM version =1.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.65, =0.0.7, =3.0.4, =3.0.6 - @toruslabs/solana-embed =0.1.4 Source cves: CVE-2024-30253 Source...

CVE-2024-32092

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...

CVE-2024-32092

CVE-2024-32092 is a CSRF vulnerability in the Kimili Flash Embed WordPress plugin (affected: 1.0 through 2.5.3). The initial description provides vulnerability type and affected versions but does not specify the exact root cause details, exploit vector, or patch information. CVSS 3.1 base metrics...

CVE-2024-32092 WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...

CVE-2024-32092 WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...

PT-2024-24397 · Unknown · Kimili Flash Embed

Name of the Vulnerable Software and Affected Versions: Kimili Flash Embed versions 2.5.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...

WordPress Plugin Kimili Flash Embed 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Kimili Flash Embed A cross-site...

WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Kimili Flash Embed versions = 2.5.3...

WordPress Kimili Flash Embed Plugin <= 2.5.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Kimili Flash Embed Type Plugin Vulnerable versions = 2.5.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32092 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0aaaa2adc731 Credits Nguyen Xuan...

CVE-2024-1571

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe...

CVE-2024-1571

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe...