CVE-2024-8907

Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML XSS via a crafted set of UI gestures. Chromium security severity: Medium...

CVE-2024-8905

Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-8906

Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

libraw:libraw_cr2_fuzzer: Index-out-of-bounds in LibRaw::ppg_interpolate

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=6407144088338432 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

clamav:clamav_dbload_PDB_fuzzer: Heap-buffer-overflow in add_hash

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=5021048003690496 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavdbloadPDBfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

keycloak:SamlMetadataParserFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Detailed Report: https://oss-fuzz.com/testcase?key=5444241445158912 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlMetadataParserFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.2.1 is vulnerable to Broken Access Control

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.2.1 Fixed in 1.4.2.2 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2024-8271 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 630dad8a94ec Credits Arkadiusz...

WordPress WCFM Marketplace Plugin <= 3.6.11 is vulnerable to Cross Site Scripting (XSS)

Software WCFM Marketplace Type Plugin Vulnerable versions = 3.6.11 Fixed in 3.6.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44009 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e15165a2d9e9 Credits Le Ngoc Anh Required privileg...

WordPress Simple Spoiler Plugin <= 1.3 is vulnerable to Broken Access Control

Software Simple Spoiler Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2024-8479 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 5815e2232ebe Credits Francesco Carlucci Required privilege...

WordPress SliceWP Plugin <= 1.1.20 is vulnerable to Cross Site Scripting (XSS)

Software SliceWP Type Plugin Vulnerable versions = 1.1.20 Fixed in 1.1.21 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8714 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c6c9e650276 Credits vgo0 Required privilege...

WordPress SKT Templates – Elementor & Gutenberg templates Plugin <= 6.14 is vulnerable to Cross Site Scripting (XSS)

Software SKT Templates – Elementor & Gutenberg templates Type Plugin Vulnerable versions = 6.14 Fixed in 6.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44007 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c6e7fe073020 Credits...

WordPress WP Booking System Plugin <= 2.0.19.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Booking System Type Plugin Vulnerable versions = 2.0.19.8 Fixed in 2.0.19.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8797 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8bb40c2d8e4 Credits vgo0...

libjpeg-turbo:decompress_yuv_fuzzer_dev: Use-of-uninitialized-value in decompress_yuv.cc

Detailed Report: https://oss-fuzz.com/testcase?key=6185125941936128 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzerdev Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: decompressyuv.cc...

WordPress YITH Custom Login Plugin <= 1.7.3 is vulnerable to Cross Site Scripting (XSS)

Software YITH Custom Login Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8665 Patch priority Medium CVSS severity Medium 7.1 Developer YITH PSID 91c2ea88e903 Credits vgo0 Required privilege...

WordPress WP Test Email Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Test Email Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8664 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea820c9f43d1 Credits vgo0 Required...

WordPress Cron Jobs Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Cron Jobs Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8731 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8773fd0a372 Credits vgo0 Required privilege...

WordPress Beauty Theme <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Beauty Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5884 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 44fa30329a12 Credits Francesco Carlucci Required...

WordPress Lucas String Replace Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Lucas String Replace Type Plugin Vulnerable versions = 2.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8734 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d57e73116724 Credits vgo0 Required...

WordPress PDF Thumbnail Generator Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software PDF Thumbnail Generator Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8737 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8724205bb063 Credits vgo0 Required...

WordPress MStore API Plugin <= 4.15.3 is vulnerable to Arbitrary File Upload

Software MStore API Type Plugin Vulnerable versions = 4.15.3 Fixed in 4.15.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-8242 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 5f5d39cca07a Credits stealthcopter Required privilege...