CVE-2023-51694: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0...

WordPress plugin Embed Privacy Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2024-14249 · Unknown · Epiphyt Embed Privacy

Name of the Vulnerable Software and Affected Versions: Epiphyt Embed Privacy versions 1.8.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can...

com.aol.microservices:micro-tomcat (>=0.83, <=0.84), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.84) +3 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aol.microservices:micro-tomcat =0.83, =0.83, =0.9.4, =0.9.12 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +6797 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m11, <=9.0.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m11, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2024-21733 Source advisory: OSV:GHSA-F4QF-M5GF-8J...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3706 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.8, <=8.5.63)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.8, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.3.0, =0.0.2, =0.0.3, =0.0.1, =1.5.19.release, =1.5.19.release, =1.5.19.release, =0.2.0, =1.6.0 and more Source cves: CVE-2024-21733 Source...

org.apache.tomcat.embed:tomcat-embed-jasper (9.0.0.m10), org.apache.tomcat.embed:tomcat-embed-websocket (9.0.0.m10) potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m10)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 9.0.0.m10 -...

org.apache.tomcat.embed:tomcat-embed-jasper (9.0.0.m9), org.apache.tomcat.embed:tomcat-embed-websocket (9.0.0.m9) potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 9.0.0.m9 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +6797 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m11, <=9.0.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m11, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2024-21733 Source advisory: GHSA-F4QF-M5GF-8JM8...

com.datadoghq:dd-java-agent (>=0.1.0, <=0.1.1), org.apache.tomcat.embed:tomcat-embed-jasper (9.0.0.m1) +1 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m1)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.datadoghq:dd-java-agent =0.1.0, =0.1.1 -...

org.apache.tomcat.embed:tomcat-embed-jasper (9.0.0.m3), org.apache.tomcat.embed:tomcat-embed-websocket (9.0.0.m3) potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 9.0.0.m3 -...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3706 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.8, <=8.5.63)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.8, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.3.0, =0.0.2, =0.0.3, =0.0.1, =1.5.19.release, =1.5.19.release, =1.5.19.release, =0.2.0, =1.6.0 and more Source cves: CVE-2024-21733 Source...

org.apache.tomcat.embed:tomcat-embed-jasper (9.0.0.m8), org.apache.tomcat.embed:tomcat-embed-websocket (9.0.0.m8) potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 9.0.0.m8 -...

com.aol.microservices:micro-tomcat (>=0.85, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.85, <=0.91.11) +6 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m6)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aol.microservices:micro-tomcat =0.85, =0.85, =1.0.0, =1.0.0, =1.0.1 -...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3706 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.8, <=8.5.63)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.8, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.3.0, =0.0.2, =0.0.3, =0.0.1, =1.5.19.release, =1.5.19.release, =1.5.19.release, =0.2.0, =1.6.0 and more Source cves: CVE-2024-21733 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +6797 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m11, <=9.0.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m11, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2024-21733 Source advisory: MEND:CVE-2024-21733...

Cross-site Scripting (XSS)

tinymce is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of proper sanitization for iframe, object and embed URL attributes within the TinyMCE's core parser. This allows an attacker to insert a specially crafted piece of content into the editor using the clipboard or APIs...

CVE-2023-6986: Improper Neutralization of Input During Web Page Generation

The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embedoembedhtml shortcode in all versions up to 3.9.5 exclusive due to insufficient inpu...

WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Embed Privacy Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51694 Patch priority Low CVSS severity Low 6.5 Developer Epiphyt PSID 5c950a5a8c2e Credits Ray Wilson Required privilege Contributor...

CVE-2023-50824

CVE-2023-50824 affects the WordPress plugin Insert or Embed Articulate Content into WordPress (versions from n/a to 4.3000000021). The issue is Stored Cross-Site Scripting due to improper input neutralization during Web Page Generation. Root cause: improper neutralization of input; impact: stored...