PT-2024-18037 · Unknown · The Post Grid – Shortcode

Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting via the section title tag attribute due to insufficient...

WordPress The Post Grid Plugin <= 7.7.1 is vulnerable to Cross Site Scripting (XSS)

Software The Post Grid Type Plugin Vulnerable versions = 7.7.1 Fixed in 7.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1427 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID a5074a7894c0 Credits wesley wcraft Required...

CVE-2024-1427: Improper Neutralization of Input During Web Page Generation

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user...

@ag-grid-enterprise/charts-enterprise (32.0.0) potentially affected by CVE-2024-39001 via @ag-grid-enterprise/charts (32.0.0)

@ag-grid-enterprise/charts NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ag-grid-enterprise/charts and may be impacted: - @ag-grid-enterprise/charts-enterprise 32.0.0 Source cves: CVE-2024-39001 Source advisory:...

@cdmx/wappler_ag_grid (>=1.2.5, <=1.7.8), @cosmotech/ui (>=8.0.0, <=9.0.0) +20 more potentially affected by CVE-2024-39001 via ag-grid-community (>=31.0.0, <=31.3.2)

ag-grid-community NPM version =31.0.0, =1.2.5, =8.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =2.7.9, =31.0.0, =31.1.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =0.1.65, =0.1.72 and more Source cves: CVE-2024-39001 Source advisory: GHSA-328P-362G-R48J...

@crystaldesign/diva-backoffice (>=24.6.0-rc.1, <=24.7.3), @steedos-widgets/ag-grid (>=3.6.2-beta.9, <=6.3.11-beta.13) +4 more potentially affected by CVE-2024-39001 via ag-grid-enterprise (>=31.0.0, <=31.3.2)

ag-grid-enterprise NPM version =31.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =0.1.65, =31.0.0, =0.0.22, =0.0.38 - react-resuable-table 1.0.0 Source cves: CVE-2024-39001 Source advisory: GHSA-328P-362G-R48J...

@nokecy/qc-ui (>=0.4.7, <=0.9.6) potentially affected by CVE-2024-39001 via ag-grid-enterprise (32.0.0)

ag-grid-enterprise NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-enterprise and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 Source cves: CVE-2024-39001 Source advisory: OSV:GHSA-328P-362G-R48J...

GHSA-328P-362G-R48J ag-grid packages vulnerable to Prototype Pollution

ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

@nokecy/qc-ui (>=0.4.7, <=0.9.6), ag-grid-charts-enterprise (32.0.0) +3 more potentially affected by CVE-2024-39001 via ag-grid-community (32.0.0)

ag-grid-community NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-community and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 - ag-grid-charts-enterprise 32.0.0 - ag-grid-enterprise 32.0.0 - ag-grid-react 32.0.0 -...

@nokecy/qc-ui (>=0.4.7, <=0.9.6) potentially affected by CVE-2024-39001 via ag-grid-enterprise (32.0.0)

ag-grid-enterprise NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-enterprise and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 Source cves: CVE-2024-39001 Source advisory: GHSA-328P-362G-R48J...

@ag-grid-enterprise/charts-enterprise (>=31.1.0, <=31.3.3) potentially affected by CVE-2024-39001 via @ag-grid-enterprise/charts (>=31.1.1, <=31.3.3)

@ag-grid-enterprise/charts NPM version =31.1.1, =31.1.0, =31.3.3 Source cves: CVE-2024-39001 Source advisory: OSV:GHSA-328P-362G-R48J...

@cdmx/wappler_ag_grid (>=1.2.5, <=1.7.8), @cosmotech/ui (>=8.0.0, <=9.0.0) +20 more potentially affected by CVE-2024-39001 via ag-grid-community (>=31.0.0, <=31.3.2)

ag-grid-community NPM version =31.0.0, =1.2.5, =8.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =2.7.9, =31.0.0, =31.1.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =0.1.65, =0.1.72 and more Source cves: CVE-2024-39001 Source advisory: OSV:GHSA-328P-362G-R48J...

@crystaldesign/diva-backoffice (>=24.6.0-rc.1, <=24.7.3), @steedos-widgets/ag-grid (>=3.6.2-beta.9, <=6.3.11-beta.13) +4 more potentially affected by CVE-2024-39001 via ag-grid-enterprise (>=31.0.0, <=31.3.2)

ag-grid-enterprise NPM version =31.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =0.1.65, =31.0.0, =0.0.22, =0.0.38 - react-resuable-table 1.0.0 Source cves: CVE-2024-39001 Source advisory: OSV:GHSA-328P-362G-R48J...

@nokecy/qc-ui (>=0.4.7, <=0.9.6), ag-grid-charts-enterprise (32.0.0) +3 more potentially affected by CVE-2024-39001 via ag-grid-community (32.0.0)

ag-grid-community NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-community and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 - ag-grid-charts-enterprise 32.0.0 - ag-grid-enterprise 32.0.0 - ag-grid-react 32.0.0 -...

ag-grid packages vulnerable to Prototype Pollution

ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

@cdmx/wappler_ag_grid (>=1.2.5, <=1.7.8), @cosmotech/ui (>=8.0.0, <=9.0.0) +20 more potentially affected by CVE-2024-38996 via ag-grid-community (>=31.0.0, <=31.3.2)

ag-grid-community NPM version =31.0.0, =1.2.5, =8.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =2.7.9, =31.0.0, =31.1.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =0.1.65, =0.1.72 and more Source cves: CVE-2024-38996 Source advisory: OSV:GHSA-876P-C77M-X2HC...

Prototype pollution in ag-grid-community via the _.mergeDeep function

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. Prior versions were also found ...

@crystaldesign/diva-backoffice (>=24.6.0-rc.1, <=24.7.3), @steedos-widgets/ag-grid (>=3.6.2-beta.9, <=6.3.11-beta.13) +4 more potentially affected by CVE-2024-38996 via ag-grid-enterprise (>=31.0.0, <=31.3.2)

ag-grid-enterprise NPM version =31.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =0.1.65, =31.0.0, =0.0.22, =0.0.38 - react-resuable-table 1.0.0 Source cves: CVE-2024-38996 Source advisory: GHSA-876P-C77M-X2HC...

@crystaldesign/diva-backoffice (>=24.6.0-rc.1, <=24.7.3), @steedos-widgets/ag-grid (>=3.6.2-beta.9, <=6.3.11-beta.13) +4 more potentially affected by CVE-2024-38996 via ag-grid-enterprise (>=31.0.0, <=31.3.2)

ag-grid-enterprise NPM version =31.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =0.1.65, =31.0.0, =0.0.22, =0.0.38 - react-resuable-table 1.0.0 Source cves: CVE-2024-38996 Source advisory: OSV:GHSA-876P-C77M-X2HC...

GHSA-876P-C77M-X2HC Prototype pollution in ag-grid-community via the _.mergeDeep function

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. Prior versions were also found ...