CVE-2024-47003

Mattermost is affected by CVE-2024-47003. The vulnerability affects Mattermost Server versions 9.11.x <= 9.11.0 and 9.5.x

CVE-2024-47003 DoS via non-string message using permalink embed

Mattermost versions 9.11.x = 9.11.0 and 9.5.x = 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend...

PT-2024-32335 · Mattermost +1 · Mattermost +1

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.0 Mattermost versions 9.5.x through 9.5.8 Description: The issue arises from the failure to validate that the message of a permalink post is a string, allowing an attacker to send a non-string value as...

PT-2024-28443 · Aimeos · Aimeos/Ai-Controller-Frontend

Name of the Vulnerable Software and Affected Versions: aimeos/ai-controller-frontend versions prior to 2024.4.2 aimeos/ai-controller-frontend versions prior to 2023.10.9 aimeos/ai-controller-frontend versions prior to 2022.10.8 aimeos/ai-controller-frontend versions prior to 2021.10.8...

Aimeos frontend controller 安全漏洞

Aimeos frontend controller is an Aimeos open source frontend controller. Aimeos frontend controller has a security vulnerability that stems from an insecure direct object reference that could allow an attacker to disable the subscribe and comment functionality for other clients. The following...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation vulnerability

Insecure Direct Object Reference to Account Takeover/Privilege Escalation vulnerability discovered by wesley wcraft in WordPress Plugin WCFM – Frontend Manager for WooCommerce versions = 6.7.12...

WordPress WCFM – Frontend Manager for WooCommerce Plugin <= 6.7.12 is vulnerable to Privilege Escalation

Software WCFM – Frontend Manager for WooCommerce Type Plugin Vulnerable versions = 6.7.12 Fixed in 6.7.13 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8290 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID...

20,000 WordPress Sites Affected by Privilege Escalation Vulnerability in WCFM – WooCommerce Frontend Manager WordPress Plugin

📢 Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024 , r esearche...

Malicious code in govuk-frontend-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef751f6f0943587997a43a2ca558b3869e5f8602c9c49fc173464bbf6e46d653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8957 Malicious code in govuk-frontend-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef751f6f0943587997a43a2ca558b3869e5f8602c9c49fc173464bbf6e46d653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45812

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

CVE-2024-45812

Vite fixed a DOM Clobbering/XSS in certain build outputs. Affected: Vite bundling with output formats cjs, iife, or umd where document.currentScript is used to resolve VITE_ASSET URLs; an attacker could shadow currentScript via the named DOM tree to swap the script tag with malicious HTML and loa...

CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

Malicious code in ably-sales-demo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1329a9a4ad55c5ef0230b58a21648b4425bbde53212764b02bffcd44be07648f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8890 Malicious code in ably-sales-demo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1329a9a4ad55c5ef0230b58a21648b4425bbde53212764b02bffcd44be07648f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

Malicious code in leaktopus-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83373d23f7e3f374eb8fc44cfa92d26ccef29ba9113f260f71e58d6dda5eea67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...