12293 matches found
WordPress NextScripts Plugin <= 4.4.3 is vulnerable to Cross Site Scripting (XSS)
Software NextScripts Type Plugin Vulnerable versions = 4.4.3 Fixed in 4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1762 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c09536c816a Credits Piotr Kuśpit Required...
WordPress Media Library Assistant Plugin <= 3.15 is vulnerable to Cross Site Scripting (XSS)
Software Media Library Assistant Type Plugin Vulnerable versions = 3.15 Fixed in 3.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3519 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f2ec0a790f20 Credits Le Ngoc Anh...
WordPress LuckyWP Table of Contents Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)
Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2119 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fd6e9deb644b Credits Lucio Sá...
netcdf:fuzz_open: Heap-buffer-overflow in NC3_open
Detailed Report: https://oss-fuzz.com/testcase?key=6202455460216832 Project: netcdf Fuzzing Engine: afl Fuzz Target: fuzzopen Job Type: aflasannetcdf Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x5030000b5e88 Crash State: NC3open NCopen ncopenmem Sanitizer: address...
opencv:imdecode_fuzzer: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6239767703388160 Project: opencv Fuzzing Engine: libFuzzer Fuzz Target: imdecodefuzzer Job Type: libfuzzerasanopencv Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffff007e3590 Crash State: NULL Sanitizer: address ASAN Recommend...
WordPress ShopLentor Plugin <= 2.8.8 is vulnerable to Broken Access Control
Software ShopLentor Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.8.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4566 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce982ce5a6fa Credits TheGreatLol Required privileg...
WordPress Sailthru Triggermail Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Software Sailthru Triggermail Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4289 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7b53f4a9625e Credits Bob Matyas Requir...
netcdf:fuzz_open: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5383087167963136 Project: netcdf Fuzzing Engine: libFuzzer Fuzz Target: fuzzopen Job Type: libfuzzerubsannetcdf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5701dc77bfe0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...
verbb/formie Server-Side Template Injection for variable-enabled settings
Impact Users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This is listed as low-medium severity due to...
matio:matio_fuzzer: Heap-buffer-overflow in Mat_VarPrint
Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=4520618547544064 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...
imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in void intra_prediction_angular<unsigned short>
Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6220087609589760 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...
libxaac:xaac_enc_fuzzer: Use-of-uninitialized-value in iusace_fd_encode_fac
Project: https://github.com/ittiam-systems/libxaac.git Detailed Report: https://oss-fuzz.com/testcase?key=5113602519400448 Project: libxaac Fuzzing Engine: libFuzzer Fuzz Target: xaacencfuzzer Job Type: libfuzzermsanlibxaac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...
libvips:webpsave_buffer_fuzzer: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5688495300476928 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: webpsavebufferfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x56a0052c4e62 Crash State: NULL Sanitizer: address ASAN...
WordPress Popup Maker WP Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)
Software Popup Maker WP Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34770 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7bf55dc1ca78 Credits Rayhan Ramdhany Hanaputra Require...
WordPress Cost Calculator Builder Pro Plugin <= 3.1.72 is vulnerable to Server Side Request Forgery (SSRF)
Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.72 Fixed in 3.1.73 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-4789 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID eba410ca734c Credits haidv35...
c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_decompressMultiFrame
Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5194340354818048 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...
WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.57 is vulnerable to PHP Object Injection
Software ShiftController Employee Shift Scheduling Type Plugin Vulnerable versions = 4.9.57 Fixed in 4.9.58 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4733 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID c137dcbad43b Credits Peter...
GHSA-39J2-4P9J-5W4J Ez Platform Object Injection in legacy shop module
This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...
Ez Platform Object Injection in legacy shop module
This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...
