CVE-2024-21730

CVE-2024-21730 describes a self-XSS in Joomla! core tied to the fancyselect list field layout, where inputs are not properly escaped. The vulnerability enables a self-XSS vector and requires user interaction for exploitation (per CVSS: UI:R, I:L, C:L). Reports consistently identify this as part o...

SUSE CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...

Joomla! Security Vulnerabilities

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! that stems from a list field layout that does not properly escape input, which can lead to a cross-site scripting XSS vulnerability...

Malicious code in sap.ui.layout (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2597 Malicious code in @panel-layout/layout (npm)

--- -= Per source details. Do not edit below this line.=-...

Adobe Audition Buffer Overflow Use-After-Free

The vulnerability of Adobe Audition is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information and bypass the ASLR protection mechanism...

CVE-2024-4626

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layouttype’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-31936

Name of the Vulnerable Software and Affected Versions JetWidgets For Elementor plugin for WordPress versions up to, and including, 1.0.17 Description The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above...

PT-2024-4223 · Adobe · Media Encoder

Name of the Vulnerable Software and Affected Versions: Adobe Media Encoder versions 23.6.5, 24.3 and earlier Description: The issue is related to an out-of-bounds read vulnerability in the Adobe Media Encoder application, which could allow an attacker to disclose sensitive memory information. Thi...

Joomla core 4.0.0-4.4.5,5.0.0-5.1.1 - Authenticated Self-XSS in fancyselect list field layout vulnerability

Authenticated Self-XSS in fancyselect list field layout vulnerability discovered by ? in WordPress Core Joomla versions 4.0.0-4.4.5,5.0.0-5.1.1...

PT-2024-35756

Name of the Vulnerable Software and Affected Versions The Elements For Elementor plugin for WordPress versions up to, and including, 2.1 Description The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server via specific...

PT-2024-35744

Name of the Vulnerable Software and Affected Versions The Responsive Owl Carousel for Elementor plugin for WordPress versions up to, and including, 1.2.0 Description The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on th...

CVE-2024-5345: Improper Control of Filename for Include/Require Statement in PHP Program

The Responsive Owl Carousel for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.0 via the layout parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary...

Adobe Photoshop Buffer Overflow Info Disclosure

The vulnerability of the Adobe Photoshop graphic editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and bypass the ASLR protection mechanism...

UBUNTU-CVE-2024-3708

A condition exists in lighttpd version prior to 1.4.51 whereby a remote attacker can craft an http request which could result in multiple outcomes: 1. cause lighttpd to access freed memory in which case the process lighttpd is running in could be terminated or other non-deterministic behavior cou...

Adobe Animate Buffer Overflow Privilege Escalation

The vulnerability of the Adobe Animate program for creating multimedia and computer animations is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and bypass the...

Adobe InDesign Memory Walking Privilege Escalation

The vulnerability of Adobe InDesign’s computer layout automation tool is related to memory-walking attacks. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and bypass security mechanisms like ASLR...

ALSA-2024:2980 Moderate: harfbuzz security update

HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: allows attackers to trigger On^2 growth via consecutive marks CVE-2023-25193 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer...

Moderate: harfbuzz security update

HarfBuzz is an implementation of the OpenType Layout engine. Security Fixes: harfbuzz: allows attackers to trigger On^2 growth via consecutive marks CVE-2023-25193 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer...

lighttpd Heap Buffer Overflow Privilege Escalation

The vulnerability of the lighttpd web server arises from the issue of operations going beyond the buffer in memory when comparing values of the If-Modified-Since header fields. Exploiting this vulnerability allows a remote attacker to bypass the ASLR protection mechanism and gain unauthorized...