WordPress Elementor Pro Plugin <= 3.21.2 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Pro Type Plugin Vulnerable versions = 3.21.2 Fixed in 3.21.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35656 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 41d6dec3f86d Credits Michael Required privilege...

libcups:fuzzipp: Use-of-uninitialized-value in _cupsStrAlloc

Project: https://github.com/OpenPrinting/libcups.git Detailed Report: https://oss-fuzz.com/testcase?key=6297513540255744 Project: libcups Fuzzing Engine: libFuzzer Fuzz Target: fuzzipp Job Type: libfuzzermsanlibcups Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Online Booking & Scheduling Calendar for WordPress by vcita Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37262 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Progress Planner Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Progress Planner Type Plugin Vulnerable versions = 0.9.2 Fixed in 0.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37422 Patch priority Medium CVSS severity Medium 6.5 Developer Emilia Projects PSID ae1b0a295095 Credits justakazh Required privilege...

WordPress Permalink Manager Lite Plugin <= 2.4.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Permalink Manager Lite Type Plugin Vulnerable versions = 2.4.3.3 Fixed in 2.4.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37257 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e3ec5eb6c45f Credits Rafie Muhammad...

WordPress NextScripts Plugin <= 4.4.6 is vulnerable to Cross Site Scripting (XSS)

Software NextScripts Type Plugin Vulnerable versions = 4.4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37275 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 14f7bee61316 Credits Rafie Muhammad Patchstack Required...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: Medium...

lz4:decompress_frame_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5857692397142016 Project: lz4 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanlz4 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7e4f6f77dd18 Crash State: NULL Sanitizer: address ASAN Recommended...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4869 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Widget Bundle Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Widget Bundle Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4616 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8a3dbf68bfd Credits Bob Matyas Required...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Online Booking & Scheduling Calendar for WordPress by vcita Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5791 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership...

WordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter Plugin <= 1.222.16 is vulnerable to Broken Access Control

Software Ultimate Custom Add To Cart Button Ajax For WooCommerce by Binary Carpenter Type Plugin Vulnerable versions = 1.222.16 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37202 Patch priority Medium CVSS severity Medium 6.5 Developer Clai...

WordPress Shortcodes by United Themes Plugin < 5.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes by United Themes Type Plugin Vulnerable versions 5.0.5 Fixed in 5.0.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37097 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6a3726b5a722 Credits Rafie Muhammad...

WordPress Master Slider Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

Software Master Slider Type Plugin Vulnerable versions = 3.10.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37222 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 90295bc054b8 Credits Rafie Muhammad Patchstack Required...

WordPress Consulting Elementor Widgets Plugin <= 1.3.0 is vulnerable to Remote Code Execution (RCE)

Software Consulting Elementor Widgets Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-37091 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 9000e26ba1f3 Credits Rafie Muhammad...

WordPress User Rights Access Manager Plugin <= 1.1.2 is vulnerable to Broken Access Control

Software User Rights Access Manager Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37209 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1f100e30e3b8 Credits Majed Refaea...

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Arbitrary File Upload

Software Pexels: Free Stock Photos Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6132 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 042650894638 Credits István Márton Required...

unit:fuzz_json: Heap-buffer-overflow in nxt_sockaddr_parse_optport

Detailed Report: https://oss-fuzz.com/testcase?key=4875165201137664 Project: unit Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerasanunit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51200000093f Crash State: nxtsockaddrparseoptport...

WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Broken Access Control

Software Scheduling Plugin – Online Booking for WordPress Type Plugin Vulnerable versions = 3.5.10 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1634 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 166eecf10900...

dlplibs:vsdxfuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6339776597262336 Project: dlplibs Fuzzing Engine: libFuzzer Fuzz Target: vsdxfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x57357c1221aa Crash State: NULL Sanitizer: address ASAN Recommended...