PT-2024-25558 · Google · Embed Google Fonts

Name of the Vulnerable Software and Affected Versions: Embed Google Fonts versions n/a through 3.1.0 Description: The issue is related to a Missing Authorization vulnerability in Embed Google Fonts. This vulnerability affects Embed Google Fonts from version n/a through 3.1.0. Recommendations: For...

CVE-2024-2542: Improper Neutralization of Input During Web Page Generation

The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied...

WordPress Embed Google Fonts plugin <= 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Embed Google Fonts versions = 3.1.0...

WordPress Embed Google Fonts Plugin <= 3.1.0 is vulnerable to Broken Access Control

Software Embed Google Fonts Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33925 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a530cac3d37a Credits Abdi Pranata Required...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-websocket-9.0.83.jar Vulnerability Details CVEID:CVE-2024-23672 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete cleanup flaw. By sending specially crafted...

CVE-2024-32775

Server-Side Request Forgery SSRF vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9...

CVE-2024-32775 WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9...

PT-2024-24847 · Unknown · Pavex Embed Google Photos Album

Name of the Vulnerable Software and Affected Versions: Pavex Embed Google Photos album versions n/a through 2.1.9 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, leading to vario...

CVE-2024-32775: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9...

Debian dsa-5667 : libtomcat9-embed-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5667 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82...

Debian dsa-5665 : libtomcat10-embed-java - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5665 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82...

GHSA-M64Q-4JQH-F72F Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Summary A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. Poc Inserting an embed with the below url can be copy/pasted onto canvas to insert as embed will log 42 to the console:...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...

@fabric-foundation/sdk (>=0.0.65, <=1.0.2-beta.6), @frakt-protocol/frakt-sdk (>=0.0.7, <=0.0.9) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.34.0)

@solana/web3.js NPM version 1.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.65, =0.0.7, =3.0.4, =3.0.6 - @toruslabs/solana-embed 0.1.4 Source cves: CVE-2024-30253 Source advisory...

@fabric-foundation/sdk (>=0.0.65, <=1.0.2-beta.6), @frakt-protocol/frakt-sdk (>=0.0.7, <=0.0.9) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.34.0)

@solana/web3.js NPM version 1.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.65, =0.0.7, =3.0.4, =3.0.6 - @toruslabs/solana-embed 0.1.4 Source cves: CVE-2024-30253 Source advisory...

CVE-2024-32092

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...

CVE-2024-32092 WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...

CVE-2024-32092

CVE-2024-32092 is a CSRF vulnerability in the Kimili Flash Embed WordPress plugin (affected: 1.0 through 2.5.3). The initial description provides vulnerability type and affected versions but does not specify the exact root cause details, exploit vector, or patch information. CVSS 3.1 base metrics...

CVE-2024-32092 WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3...