WordPress Tainacan Plugin <= 0.21.10 is vulnerable to Cross Site Scripting (XSS)

Software Tainacan Type Plugin Vulnerable versions = 0.21.10 Fixed in 0.21.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9221 Patch priority Medium CVSS severity Medium 7.1 Developer Tainacan Community PSID 3d12acf57920 Credits Colin Xu Required...

WordPress Maximum Products per User for WooCommerce Plugin <= 4.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Maximum Products per User for WooCommerce Type Plugin Vulnerable versions = 4.2.8 Fixed in 4.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9205 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7a571f465eb2...

WordPress Featured Posts with Multiple Custom Groups (FPMCG) Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Featured Posts with Multiple Custom Groups FPMCG Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48032 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 757e14242f05 Credits Mik...

WordPress Shortcodes AnyWhere Plugin <= 1.0.1 is vulnerable to Content Injection

Software Shortcodes AnyWhere Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9581 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 9c5d59c3c6ea Credits Francesco Carlucci Required privilege...

Upgrade tinyMCE to >= 7.0.0 to mitigate CVE-2024-29881/29203

h3. Issue Summary The current tinyMCE version used on the latest version of Jira is 5.10.9. There are two outstanding CVEs between the delta of 5.10.9 to 7.0.0 that don't seem to be backported yet: CVE-2024-29881 Detail - NVD|https://nvd.nist.gov/vuln/detail/CVE-2024-29881 CVE-2024-29203 Detail -...

WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 – PayPal & Stripe Add-on Type Plugin Vulnerable versions = 2.3 Fixed in 2.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48021 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e2541d5dd28 Credits Le Ngoc An...

libultrahdr:ultrahdr_enc_fuzzer: Heap-buffer-overflow in convsamp

Project: https://github.com/google/libultrahdr.git Detailed Report: https://oss-fuzz.com/testcase?key=5315356366798848 Project: libultrahdr Fuzzing Engine: afl Fuzz Target: ultrahdrencfuzzer Job Type: aflasanlibultrahdr Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

assimp:assimp_fuzzer: Crash in __dynamic_cast

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4791471151054848 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash...

WordPress Captcha Bank Plugin <= 4.0.36 is vulnerable to Cross Site Scripting (XSS)

Software Captcha Bank Type Plugin Vulnerable versions = 4.0.36 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9375 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 514f49188a6e Credits vgo0 Required privileg...

WordPress Popularis Extra Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Popularis Extra Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9353 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a36990b7c214 Credits vgo0 Required...

WordPress Fish and Ships Plugin <= 1.5.9 is vulnerable to Cross Site Scripting (XSS)

Software Fish and Ships Type Plugin Vulnerable versions = 1.5.9 Fixed in 1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9237 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7e6c47fc694c Credits vgo0 Required privile...

Advisory ROSA-SA-2024-2505

SOFTWARE: 389-ds-base 1.4.3.8 OS: ROSA Virtualization 2.1 packageevrstring: 389-ds-base-1.4.3.8-5.0.2.rv3 CVE-ID: CVE-2020-35518 BDU-ID: 2023-02645 CVE-Crit: MEDIUM CVE-DESC.: A 389 Directory Server authentication vulnerability involves information disclosure when verifying the existence of a...

wt:fuzz-eval: Crash in LLVMFuzzerRunDriver

Detailed Report: https://oss-fuzz.com/testcase?key=4506830829584384 Project: wt Fuzzing Engine: afl Fuzz Target: fuzz-eval Job Type: aflasanwt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5240000c8010 Crash State: LLVMFuzzerRunDriver Sanitizer: address ASAN Recommended Security...

WordPress Magazine Blocks Plugin <= 1.3.14 is vulnerable to Cross Site Scripting (XSS)

Software Magazine Blocks Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9218 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d9dae2ee7e0f Credits Colin Xu Require...

mongo-go-driver:fuzz_decode: Crash in fuzz_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5157460095074304 Project: mongo-go-driver Fuzzing Engine: libFuzzer Fuzz Target: fuzzdecode Job Type: libfuzzerasanmongo-go-driver Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: fuzzdecode Sanitizer:...

WordPress Loggedin Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Loggedin Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9228 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ab329401c416 Credits vgo0 Required privilege...

WordPress Optin Hound Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Optin Hound Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9267 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 08d5a68f0d8b Credits Francesco Carlucci...

WordPress Robokassa payment gateway for Woocommerce Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Robokassa payment gateway for Woocommerce Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47395 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 06b4d95a8c74 Credits Dimas...

WordPress WPCOM Member Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Software WPCOM Member Type Plugin Vulnerable versions = 1.5.4 Fixed in 1.5.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47378 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5f883b482d88 Credits Muhamad Agil Fachrian Required...

libjpeg-turbo:decompress_yuv_fuzzer_2_1_x: Use-of-uninitialized-value in decompress_yuv.cc

Detailed Report: https://oss-fuzz.com/testcase?key=6496856224366592 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzer21x Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: decompressyuv.cc...