CVE-2024-31983 XWiki Platform: Remote code execution from edit in multilingual wikis via translations

XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations script right for user-scope translations, wiki admin for translations on the wiki. Starting i...

XWiki Platform: Remote code execution from edit in multilingual wikis via translations

Impact In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations script right for user-scope translations, wiki admin for translations on the wiki. This can be exploited for remote code executio...

GHSA-XXP2-9C9G-7WMJ XWiki Platform: Remote code execution from edit in multilingual wikis via translations

Impact In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are normally required for authoring translations script right for user-scope translations, wiki admin for translations on the wiki. This can be exploited for remote code executio...

WooCommerce Multilingual & Multicurrency < 5.3.5 - Missing Authorization

Description The WooCommerce Multilingual & Multicurrency plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an...

WordPress WooCommerce Multilingual & Multicurrency Plugin <= 5.3.4 is vulnerable to Broken Access Control

Software WooCommerce Multilingual & Multicurrency Type Plugin Vulnerable versions = 5.3.4 Fixed in 5.3.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30466 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a9e0969e36a2 Credits Rafi...

Translate WordPress and go Multilingual – Weglot < 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

Description The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such ...

Path traversal

Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" lgsitemaps module for PrestaShop before version 1.6.6, a guest can download personal information without restriction...

CVE-2024-24311

Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" lgsitemaps module for PrestaShop before version 1.6.6, a guest can download personal information without restriction...

CVE-2024-24311

Path Traversal in PrestaShop module lgsitemaps (Multilingual and Multistore Sitemap Pro - SEO) prior to version 1.6.6 allows a guest to download personal information. Affected: PrestaShop with the lgsitemaps module. Root cause: path traversal vulnerability in the module. Impact: unauthorized disc...

[SECURITY] Fedora 39 Update: filezilla-3.66.4-1.fc39

FileZilla is a FTP, FTPS and SFTP client for Linux with a lot of features. - Supports FTP, FTP over SSL/TLS FTPS and SSH File Transfer Protocol SFTP - Cross-platform - Available in many languages - Supports resume and transfer of large files greater than 4GB - Easy to use Site Manager and transfe...

Fedora: Security Advisory for filezilla (FEDORA-2023-7934efb5e3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Unveils RETVec - Gmail's New Defense Against Spam and Malicious Emails

Google has revealed a new multilingual text vectorizer called RETVec short for Resilient and Efficient Text Vectorizer to help detect potentially harmful content such as spam and malicious emails in Gmail. "RETVec is trained to be resilient against character-level manipulations including insertio...

[SECURITY] Fedora 37 Update: roundcubemail-1.6.5-1.fc37

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 39 Update: roundcubemail-1.6.5-1.fc39

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Babel Security Vulnerabilities

Babel is a multilingual support module used in content management systems. A security vulnerability exists in Babel. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor's announcement...

Security Bulletin: Vulnerability in snappy-java affects IBM Process Mining . CVE-2023-34453

Summary There is a vulnerability in snappy-java that could allow a remote attacker to execute a denial of service. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34453 DESCRIPTION:...

[SECURITY] Fedora 38 Update: roundcubemail-1.6.3-1.fc38

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

WordPress Advanced Exchange Rates for WooCommerce Multilingual Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Exchange Rates for WooCommerce Multilingual Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ac20ba53363a Credi...

Gergana Karadzhova-Dangela wants to send the ladder back down to the next generation of incident responders

Gergana Karadzhova-Dangela is used to being with users during some of their toughest moments. Today, she spends much of her time responding to active cybersecurity incidents with Cisco Talos Incident Response, helping customers work through active attacks, many of which put personal data or...

CVE-2023-2472

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which...