WordPress Contextual Related Posts Plugin < 3.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Contextual Related Posts Type Plugin Vulnerable versions 3.3.1 Fixed in 3.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0252 Patch priority Medium CVSS severity Medium 6.3 Developer WebberZone PSID bc7f8f79c949 Credits István Márton...

WordPress YouTube Channel Plugin <= 3.0.12.1 is vulnerable to Broken Access Control

Software YouTube Channel Type Plugin Vulnerable versions = 3.0.12.1 Fixed in 3.23.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0447 Patch priority Medium CVSS severity Medium 4.3 Developer Aleksandar Urošević PSID 5cd4c6177416 Credits WordfenceTeam...

WordPress List Pages Shortcode Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Software List Pages Shortcode Type Plugin Vulnerable versions = 1.7.5 Fixed in 1.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 30aa61094340 Credits Lana Codes Required...

WordPress Panda Pods Repeater Field Plugin < 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Software Panda Pods Repeater Field Type Plugin Vulnerable versions 1.5.4 Fixed in 1.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4306 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3af98eaf0325 Credits cydave...

CVE-2022-0801

Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. Chrome security severity: Medium...

CVE-2022-0801

Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. Chrome security severity: Medium...

graphicsmagick:coder_RAS_fuzzer: Heap-buffer-overflow in ReadSUNImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=4885054235213824 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderRASfuzzer Job Type: libfuzzerasani386graphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ...

hunspell:affdicfuzzer: Use-of-uninitialized-value in AffixMgr::cpdpat_check

Project: https://github.com/hunspell/hunspell.git Detailed Report: https://oss-fuzz.com/testcase?key=6429122996076544 Project: hunspell Fuzzing Engine: libFuzzer Fuzz Target: affdicfuzzer Job Type: libfuzzermsanhunspell Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

WordPress WPZOOM Portfolio Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WPZOOM Portfolio Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4789 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 6f91f80a704a Credits István Márton...

systemd:fuzz-time-util: Use-of-uninitialized-value in rename_process

Detailed Report: https://oss-fuzz.com/testcase?key=5339469178077184 Project: systemd Fuzzing Engine: libFuzzer Fuzz Target: fuzz-time-util Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: renameprocess safeforkfull parsetimestamp...

WordPress Product Slider for WooCommerce Plugin < 2.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Product Slider for WooCommerce Type Plugin Vulnerable versions 2.6.4 Fixed in 2.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4629 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 97b9b3d3fb3c Credits Istvá...

ntpsec:FuzzClient: Use-of-uninitialized-value in nts_client_process_response_core

Project: https://gitlab.com/NTPsec/ntpsec.git Detailed Report: https://oss-fuzz.com/testcase?key=5360233063251968 Project: ntpsec Fuzzing Engine: libFuzzer Fuzz Target: FuzzClient Job Type: libfuzzermsanntpsec Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ntpsec:FuzzExtens: Use-of-uninitialized-value in extens_server_recv

Detailed Report: https://oss-fuzz.com/testcase?key=5977465670991872 Project: ntpsec Fuzzing Engine: libFuzzer Fuzz Target: FuzzExtens Job Type: libfuzzermsanntpsec Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: extensserverrecv FuzzExtens.c Sanitizer: memory...

Vulnerabilities fixed in Mattermost

Unspecified vulnerabilities have been fixed in MatterMost. Mattermost has not released any substantive information released, but estimates the severity of the vulnerabilities as MEDIUM. The grading of this security advisory is accordingly accordingly. MatterMost indicates in accordance with their...

Potential race condition when claiming prize

Lines of code Vulnerability details Impact To determine whether a caller has won the raffle, the hasUserWon function of the VRFNFTRandomDraw contract queries the ownerOf function of the drawingToken contract, passing the currentChosenTokenId as argument. In essence, the function is only checking...

DEBIAN-CVE-2022-4440

Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-4440

Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2022-4440

Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

wolfssl:fuzzer-wolfssl-ocsp: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5864925224632320 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-ocsp Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

GHSA-MCVF-2Q2M-X72M Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as Medium Severity 6.1. References - CWE - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 4.9 - SVG MIME Type...