Cross-site Scripting (XSS)

Overview piranha is an a complete rewrite of Piranha CMS for .NET Core. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /manager/pages endpoint, as a markdown content. PoC 1 Login via the manager endpoint :: /manager/login 2 Navigate to the "Pages" Content 3...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2024-27306: filenames and paths not escaped when generating index pages for static file handling. bsc1223098 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypp...

CVE-2024-55341

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

CVE-2024-55341: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

Malicious code in deploy-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 176f868a287ef5a5af82a0534c36ef855e91bf0a605106d0af59408ed0fba7e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in configure-pages

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-11966 Malicious code in deploy-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 176f868a287ef5a5af82a0534c36ef855e91bf0a605106d0af59408ed0fba7e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in configure-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79cd1afeb9acab2c5d187d719ceadc3a57f71df17a7d824796c4d9fbcb61081b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in deploy-pages

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2024-53257

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

CVE-2024-47810

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs ...

PT-2024-16863 · WordPress · Amp For Wp

Name of the Vulnerable Software and Affected Versions: AMP for WP – Accelerated Mobile Pages plugin for WordPress versions prior to 1.1.2 Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus name parameter due t...

CVE-2024-11254: Improper Neutralization of Input During Web Page Generation

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqusname parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11280 PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been...

CVE-2024-11280

CVE-2024-11280 affects the PPWP – Password Protect Pages plugin for WordPress. The issue enables sensitive information exposure through the WordPress core search feature, allowing unauthenticated users to access restricted post data. Connected sources corroborate the vulnerability description and...

CVE-2024-11280 PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been...

WordPress plugin PPWP – Password Protect Pages: Information leakage vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

PT-2024-16881 · WordPress · Ppwp – Password Protect Pages

Name of the Vulnerable Software and Affected Versions: PPWP – Password Protect Pages plugin for WordPress versions up to, and including, 1.9.5 Description: The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress core search feature...

CVE-2024-11280: Exposure of Sensitive Information to an Unauthorized Actor

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been...

Next.js authorization issue vulnerabilities

Next.js is a React framework open-sourced by Vercel. An authorization issue vulnerability exists in versions of Next.js prior to 14.2.15, which stems from the fact that if an application performs authorization in middleware based on a pathname, a page in the root directory of the application may...