PT-2024-6208 · Unknown +2 · Hdf5 Library +2

Name of the Vulnerable Software and Affected Versions: HDF5 Library versions prior to 1.14.4 Description: The issue is related to the function H5E printf stack in the file H5Eint.c of the HDF5 Library, which is associated with uncontrolled recursion. This can lead to stack consumption. Exploitati...

WordPress Swift Performance Lite Plugin <= 2.3.6.18 is vulnerable to Broken Access Control

Software Swift Performance Lite Type Plugin Vulnerable versions = 2.3.6.18 Fixed in 2.3.6.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3722 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4365655c4219 Credits Lucio Sá Required...

PT-2024-25890 · Unknown · Skt Addons For Elementor

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor versions 1.8 and earlier Description: The issue affects SKT Addons for Elementor, allowing Stored XSS due to improper neutralization of input during web page generation. This is a type of Cross-site Scripting...

WordPress Church Admin Plugin <= 4.1.32 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Admin Type Plugin Vulnerable versions = 4.1.32 Fixed in 4.2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34828 Patch priority Low CVSS severity Low 4.3 Developer Andy Moyle PSID 2d0beb058c1b Credits Dhabaleshwar Das Required...

WordPress Porto Theme - Functionality Plugin <= 3.1.0 is vulnerable to Local File Inclusion

Software Porto Theme - Functionality Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3808 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 05d6982e8315 Credits István Márton Required privileg...

CVE-2024-27281

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

CVE-2024-27280

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fix...

PT-2024-25343 · Vitepos · Vitepos

Name of the Vulnerable Software and Affected Versions: Vitepos versions 3.0.1 and earlier Description: A Missing Authorization issue affects the software, allowing potential unauthorized access. The estimated number of potentially affected devices worldwide is not specified. There is no informati...

WordPress Link Library Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)

Software Link Library Type Plugin Vulnerable versions = 7.6.11 Fixed in 7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4281 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID abed5ec79423 Credits Krzysztof Zając Required...

Trix Editor Arbitrary Code Execution Vulnerability

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts...

WordPress SKT Addons for Elementor Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software SKT Addons for Elementor Type Plugin Vulnerable versions = 1.8 Fixed in 1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79dec302ec7b Credits Khalid Yusuf Required privilege...

WordPress Fancy Elementor Flipbox Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Fancy Elementor Flipbox Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.6.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34572 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6fdd1efa32f5 Credits Khalid Yusuf Required privileg...

WordPress Beaver Builder Plugin <= 2.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.8.1.1 Fixed in 2.8.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3923 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 38b338352313 Credits wesley wcraft Require...

WordPress Gold Addons for Elementor Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Gold Addons for Elementor Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34563 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ec8bc999d21 Credits Khalid Yusuf Required...

WordPress Magical Addons For Elementor Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.34 Fixed in 1.1.35 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34547 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 74ccb66566e9 Credits Khalid Yusuf Required...

WordPress Shared Files Plugin <= 1.7.19 is vulnerable to Broken Access Control

Software Shared Files Type Plugin Vulnerable versions = 1.7.19 Fixed in 1.7.20 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34438 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID 04ad9b91bcca Credits domiee13 Required privilege...

CVE-2024-34078

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2024-34064

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as...

AZL-40466 CVE-2024-34069 affecting package python-werkzeug for versions less than 2.3.7-2

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

WordPress Hostel Plugin <= 1.1.5.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hostel Type Plugin Vulnerable versions = 1.1.5.3 Fixed in 1.1.5.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4314 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5c8220b39532 Credits Benedictus Jovan aillesiM...