PT-2024-37752 · WordPress · The Rss Aggregator

Name of the Vulnerable Software and Affected Versions: The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to, and including, 4.23.11 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify dat...

WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHee Kang in WordPress Plugin Admin Dashboard RSS Feed versions = 3.1...

CVE-2024-6256

CVE-2024-6256 affects the WordPress plugin Feeds for YouTube (YouTube video, channel, and gallery). The issue is a Stored XSS in the youtube-feed shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contri...

PT-2024-37488 · WordPress · Feeds For Youtube

Name of the Vulnerable Software and Affected Versions: The Feeds for YouTube plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode due to insufficient input sanitization and output...

WordPress Admin Dashboard RSS Feed Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

Software Admin Dashboard RSS Feed Type Plugin Vulnerable versions = 3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38725 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d6cc5ed45dc7 Credits younsoung kim, SeoHyeon Lee,...

The vulnerability in the implementation of the application software interface of the Cisco AsyncOS operating system of the Cisco Secure Email Gateway (formerly known as Cisco Email Security Appliance) allows a attacker to carry out XSS attacks.

The vulnerability of the application programming interface of the Cisco AsyncOS operating system in the Cisco Secure Email Gateway formerly Cisco Email Security Appliance security system is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a...

Liferea: Remote Code Execution

Background Liferea is a feed reader/news aggregator that brings together all of the content from your favorite subscriptions into a simple interface that makes it easy to organize and browse feeds. Its GUI is similar to a desktop mail/news client, with an embedded web browser. Description A...

URL Rewrite

zendframework/zend-feed is vulnerable to URL Rewrite. The vulnerability is due to marshaling a request URI that includes logic to introspect HTTP request headers specific to a server-side URL rewrite mechanism. The attacker can emulate these headers to request arbitrary content...

Denial Of Service (DoS)

ZenML is vulnerable to a Denial Of Service DoS. The vulnerability is due to improper handling of line feed \n characters in component names, allowing an attacker to cause uncontrolled resource consumption by adding a component through an API endpoint api/v1/workspaces/default/components...

Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

PT-2024-31195

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3 Description A denial of service issue exists due to improper handling of line feed characters in component names. When a low-privileged user adds a component through the API endpoint...

Cross-site Request Forgery (CSRF)

zendframework/zend-feed is vulnerable to Cross-site Request Forgery CSRF. The vulnerability is due to the request URI marshalling logic that introspects specific HTTP request headers, allowing a malicious client or proxy to emulate these headers and request arbitrary content...

CVE-2024-6059

A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /emgui/rest/ums/messages of the component News Feed. The manipulation of the argument message leads to cross site scripting. The attack may ...

CVE-2024-6059 Ingenico Estate Manager News Feed messages cross site scripting

A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /emgui/rest/ums/messages of the component News Feed. The manipulation of the argument message leads to cross site scripting. The attack may ...

PT-2024-37353 · Ingenico · Ingenico Estate Manager

Name of the Vulnerable Software and Affected Versions: Ingenico Estate Manager version 2023 Description: A problematic issue has been found in the News Feed component, affecting the processing of the file /emgui/rest/ums/messages. The manipulation of the message argument leads to cross-site...

The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the failure to handle CRLF sequences properly, allows a violator to execute arbitrary code.

The vulnerability of Ivanti Connect Secure previously known as Pulse Connect Secure and Ivanti Policy Secure lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted data containing the CRLF...

CVE-2024-35699

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8...

CVE-2024-35699

CVE-2024-35699 is a Stored XSS flaw in HT Feed (HasThemes) affecting HT Feed versions up to 1.2.8. The issue arises from improper input neutralization during web page generation, enabling authenticated users to inject scripts. Red Hat/ENISA Wordfence context confirms the vulnerability and notes a...

CVE-2024-35699 WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8...

WordPress plugin HT Feed cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...