15972 matches found
CVE-2024-4780 Image Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter
The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihelink’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Ultimate Addons for WPBakery Page Builder < 3.19.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimateinfobanner shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This...
Pixel Watch Security Bulletin—July 2024Stay organized with collectionsSave and categorize content based on your preferences.
The Pixel Watch Security Bulletin contains details of security vulnerabilities affecting Pixel Watch devices Google Devices. For Google devices, security patch levels of 2024-07-05 or later address all applicable issues in the July 2024 Android Security Bulletin and all issues in this bulletin. T...
The vulnerability of the XStreamSerializer class in the Mirth Connect healthcare management optimization tool allows a perpetrator to execute arbitrary commands.
The vulnerability of the XStreamSerializer class in the Mirth Connect healthcare management optimization tool is related to the lack of data cleansing measures at the administrative level. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary commands...
CVE-2024-6465 WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplfajaxupdatescreenshots' function in all versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and...
BIT-GITLAB-2024-5470 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with adminpushrules permission may have been able to create project-level deploy tokens...
USB Support in XenApp/XenDesktop Server Products
This article contains information about USB Support in XenApp. USB Support in XenApp/XenDesktop Citrix support for peripherals attached to a client device is a fundamental functionality leveraged by the Citrix Server Based Computing SBC model. Support for many client-side peripherals exists...
Provisioning Services Console Error is Displayed During KMS Activation
When changing a virtual disk vDisk in private mode to KMS activation and then changing the mode to standard image modeor changing the activation procedure to KMS for a vDisk in standard image mode, the following error message appears, which can be seen in the console.log when in debug level or in...
CVE-2024-5325
The vulnerability CVE-2024-5325 affects Form Vibes – Database Manager for Forms (WordPress plugin). It is a SQL Injection via the fv_export_data parameter in all versions up to 1.4.10, caused by insufficient escaping and lack of prepared statements. Authenticated users with Subscriber+ privileges...
CVE-2024-6495 Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Security Bulletin: pdfmake vulnerability affect IBM Spectrum Control
Summary Vulnerability in pdfmake could allow a remote attacker to execute arbitrary code on the system, which could affect IBM Spectrum Control. CVE-2024-25180. Vulnerability Details CVEID:CVE-2024-25180 DESCRIPTION: pdfmake could allow a remote attacker to execute arbitrary code on the system,...
CVE-2024-6353 Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'searchvalue' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
Mozilla: Race condition in permission assignment
The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...
Mozilla: Race condition in permission assignment
The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...
Mozilla: Race condition in permission assignment
The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...
CVE-2024-5470
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with adminpushrules permission may have been able to create project-level deploy tokens...
CVE-2024-5470
Removed by vendor...
CVE-2024-5470 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with adminpushrules permission may have been able to create project-level deploy tokens...
GitLab CE/EE Security Vulnerabilities
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE version 17.0 up to and includi...