CVE-2024-2458

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-30263

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the file parameter. Users with view rights can access restricted PDF attachments if the...

CVE-2024-30263 The PDF Viewer macro can be used to view PDF attachments with restricted access

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the file parameter. Users with view rights can access restricted PDF attachments if the...

CVE-2024-20800

Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2024-20800 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome versions prior to 123.0.6312.105, which stems from a vulnerability that allows an attacker to perform out-of-bounds memory access via specially crafted HTML pages...

PT-2024-21613 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the userfaultfd feature in the Linux kernel, where the src folio is changed after ensuring it's unpinned in UFFDIO MOVE. A commit was made to fix an unexpected chang...

PT-2024-26800

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the error path in the panfrost mmu map fault addr function. If page or sgt allocation fails, the code should not release the pages ref obtained earlier to avoid...

PT-2024-23306 · Mozilla · Pdf.Js

Name of the Vulnerable Software and Affected Versions: macro-pdfviewer versions prior to 2.5.1 Description: The macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro by passing the attachment U...

UBUNTU-CVE-2024-26696

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfslookupdirtydatabuffers Syzbot reported a hang issue in migratepagesbatch called by mbind and nilfslookupdirtydatabuffers called in the log writer of nilfs2. While migratepagesbatch locks a folio and waits...

Landingi Landing Pages < 3.1.2 - Cross-Site Request Forgery

Description The Landingi Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the action function. This makes it possible for unauthenticated attackers to update settings via...

PT-2024-21471

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A hang issue was reported in the Linux kernel, specifically in the nilfs2 file system. The issue occurs when the migrate pages batch function, called by mbind, locks a folio and waits fo...

PT-2024-3797 · Mozilla · Firefox

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 124 Description: The issue is related to insufficient input validation when dragging URL addresses into the address bar, allowing a remote attacker to bypass security restrictions and load arbitrary pages. Th...

Unlimited Elements For Elementor < 1.5.94 - Reflected Cross-Site Scripting

Description The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an...

Server-Side Template Injection (SSTI)

wintercms/winter is vulnerable to Server-side Template Injection SSTI. The vulnerability is due to insufficient input validation, allowing an admin authenticated remote attacker to execute arbitrary code by injecting a crafted payload into the CMS Pages field and Plugin components...

[SECURITY] Fedora 39 Update: seamonkey-2.53.18.2-1.fc39

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...

Winter CMS Server-Side Template Injection (SSTI) vulnerability

Server-side Template Injection SSTI vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components...

GHSA-8R5J-GM3J-CX9C Winter CMS Server-Side Template Injection (SSTI) vulnerability

Server-side Template Injection SSTI vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components...

CVE-2024-30521

Cross-Site Request Forgery CSRF vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1...

CVE-2024-30521

Technical details for CVE-2024-30521 are not publicly provided in the supplied documents. Monitor for updates from the vendor/maintainers and reputable advisories if you rely on Landingi Landing Pages to assess risk and mitigations.