CVE-2024-9769 Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9769

CVE-2024-9769 corresponds to the WordPress Video Gallery – YouTube Gallery plugin vulnerability: stored cross-site scripting via admin settings in all versions up to 2.4.1. Exploitation requires authenticated access with administrator-level permissions (and above) and is restricted to multisite i...

CVE-2024-11379: Improper Neutralization of Input During Web Page Generation

The Broadcast plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'docheck' parameter in all versions up to, and including, 51.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-9769: Improper Neutralization of Input During Web Page Generation

The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-39831 · WordPress · The Video Gallery – Best Wordpress Youtube Gallery

Name of the Vulnerable Software and Affected Versions: The Video Gallery – Best WordPress YouTube Gallery plugin versions up to, and including, 2.4.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Thi...

DRUPAL-CONTRIB-2024-071

This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact...

7 PAM Best Practices to Secure Hybrid and Multi-Cloud Environments

Are you using the cloud or thinking about transitioning? Undoubtedly, multi-cloud and hybrid environments offer numerous benefits for organizations. However, the cloud's flexibility, scalability, and efficiency come with significant risk — an expanded attack surface. The decentralization that com...

blk-mq Kernel DoS

The vulnerability of the blk-mq component in the Linux operating system’s kernel is related to the assignment of the NULL pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

Element Synapse security vulnerability

Element Synapse is an open source Matrix Home Server implementation from Element Open Source. A security vulnerability exists in Element Synapse that stems from the fact that multi-part/form data requests may, under certain configurations, temporarily increase memory consumption beyond expected...

GHSA-MFJ5-CF8G-G2FV AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

Summary When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie...

CVE-2024-53990

The CVE-2024-53990 issue affects the AsyncHttpClient (AHC) library where an auto-enabled CookieStore silently replaces cookies with the same name from the cookie jar. This can cause cookies from one user to be used in another user’s requests, creating potential unauthorized data exposure in multi...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53718

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through = 2.2.4...

CVE-2024-53718

CVE-2024-53718 is a CSRF to Stored XSS vulnerability affecting the WordPress Multi Feed Reader plugin (versions

CVE-2024-53718 WordPress Multi Feed Reader plugin <= 2.2.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through 2.2.4...

CVE-2024-53718 WordPress Multi Feed Reader plugin <= 2.2.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through = 2.2.4...

CVE-2024-53718: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through = 2.2.4...

PT-2024-35747

Name of the Vulnerable Software and Affected Versions Sysax Multi Server version 6.99 Description The issue is related to Cross Site Scripting XSS via the "/scgi?sid" API endpoint. This allows for potential malicious script injection. No information is provided about the estimated number of...