CVE-2024-6987 Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress Fuse Social Floating Sidebar plugin <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Fuse Social Floating Sidebar versions = 5.4.10...

PT-2024-38024 · WordPress +1 · Orchid Store +1

Name of the Vulnerable Software and Affected Versions: Orchid Store theme for WordPress versions up to, and including, 1.5.6 Description: The issue is related to a missing capability check on the orchid store activate plugin function, allowing authenticated attackers with Subscriber-level access...

WordPress plugin Fuse Social Floating Sidebar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2024:2803-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2803-1 advisory. - CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug in loadinputpicture...

CVE-2024-5226: Improper Neutralization of Input During Web Page Generation

The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level...

PT-2024-35138 · WordPress · Fuse Social Floating Sidebar

Name of the Vulnerable Software and Affected Versions: Fuse Social Floating Sidebar plugin for WordPress versions up to, and including, 5.4.10 Description: The issue is related to Stored Cross-Site Scripting via the file upload functionality due to insufficient validation of SVG files. This allow...

CVE-2024-6987: Missing Authorization

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

SUSE-SU-2024:2803-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug in loadinputpicture bsc1227296. - CVE-2023-51798: Fixed floating point exception in the via the interpolate function in libavfilter/vfminterpolate.c bsc1223304...

CVE-2024-4090: Improper Neutralization of Input During Web Page Generation

The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredht...

SUSE SLED15: espeak-ng / espeak-ng-compat / espeak-ng-compat-devel / etc (SUSE-SU-2024:2632-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2632-1 advisory. - CVE-2023-49990: Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c bsc1218010 ...

SUSE-SU-2024:2632-1 Security update for espeak-ng

This update for espeak-ng fixes the following issues: - CVE-2023-49990: Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c bsc1218010 - CVE-2023-49991: Fixed stack-buffer-underflow exists in the function CountVowelPosition in synthdata.c bsc1218006 - CVE-2023-49992: Fixed...

PT-2024-32763

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to the handling of floating point instructions in userspace, which can cause some ARM kernels built with clang/LLD 17.0.6 to crash. The problem occurs when the kernel is...

CVE-2024-37545

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2...

CVE-2024-37545

CVE-2024-37545 (Floating Social Media Links) is a Stored XSS in the WordPress plugin. Affected: versions

CVE-2024-37545 WordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2...

PT-2024-27642 · Unknown · Nick Halsey Floating Social Media Links

Name of the Vulnerable Software and Affected Versions: Nick Halsey Floating Social Media Links versions 1.5.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

CVE-2024-37545: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2...

WordPress Floating Social Media Links Plugin <=1.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Floating Social Media Links Type Plugin Vulnerable versions =1.5.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37545 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dc49f507dff4 Credits Sharanabasappa Required...

WordPress Floating Social Buttons plugin <= 1.5 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Yoshihito Kamata in WordPress Plugin Floating Social Buttons versions = 1.5...