OPENSUSE-SU-2025:14862-1 less-668-2.1 on GA media

These are all security issues fixed in the less-668-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-25142

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through = 1.3.0...

Linux Distros Unpatched Vulnerability : CVE-2014-9488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The isutf8wellformed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an...

CVE-2025-1801

A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the...

CVE-2025-25142

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through = 1.3.0...

CVE-2025-25142

CVE-2025-25142 describes a Stored XSS vulnerability in the WordPress WP Less Compiler plugin (versions up to 1.3.0). The issue arises from improper neutralization of input during web page generation, allowing attacker-supplied input to be stored and later reflected in pages. The advisory lists WP...

CVE-2025-25142 WordPress WP Less Compiler plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Less Compiler allows Stored XSS. This issue affects WP Less Compiler: from n/a through 1.3.0...

CVE-2025-25142 WordPress WP Less Compiler plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through = 1.3.0...

WordPress plugin WP Less Compiler 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.

...

CBL Mariner 2.0 Security Update: less (CVE-2022-48624)

The version of less installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-48624 advisory. - closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Note that...

less Vulnerable to Arbitrary Code Execution via OS Command Execution via newline Character in Filename

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the...

CVE-2024-10563 WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a null pointer dereference that may result from a device-less frame buffer dereference...

CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Summary The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs e.g., https://evil.com, it incorrectly allows...

GHSA-HJPM-7MRM-26W8 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Summary The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs e.g., https://evil.com, it incorrectly allows...

CVE-2024-13314 Carousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSS

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

AZL-57019 CVE-2025-0633 affecting package iniparser for versions less than 4.1-8

Heap-based Buffer Overflow vulnerability in iniparserdumpsectionini in iniparser allows attacker to read out of bound memory...

PT-2025-6552 · WordPress · Ltl Freight Quotes – Estes Edition

Name of the Vulnerable Software and Affected Versions: LTL Freight Quotes – Estes Edition plugin for WordPress versions up to, and including, 3.3.7 Description: The issue allows unauthenticated attackers to perform SQL Injection via the dropship edit id and edit id parameters due to insufficient...