PT-2024-15558 · WordPress · Wptravelly

Name of the Vulnerable Software and Affected Versions: WpTravelly plugin for WordPress versions prior to 1.7.2 Description: The issue allows unauthorized modification of data due to a missing capability check on the ttbm new place save function. This enables unauthenticated attackers to create an...

How a Right-Wing Controversy Could Sabotage US Election Security

Republicans who run elections are split over whether to keep working with the Cybersecurity and Infrastructure Security Agency to fight hackers, online falsehoods, and polling-place threats...

flusity CMS Security Vulnerability

flusity CMS is a user interactive interface solution where code can be easily changed or added. A security vulnerability exists in flusity CMS version v2.33, which was discovered to contain a cross-site request forgery CSRF vulnerability via the component /core/tools/deleteplace.php...

CVE-2024-26351

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/updateplace.php...

CVE-2024-26351

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/updateplace.php...

flusity CMS Security Vulnerability

flusity CMS is a user interactive interface solution where code can be easily changed or added. A security vulnerability exists in flusity CMS version v2.33, which was discovered to contain a cross-site request forgery CSRF vulnerability via the component /core/tools/updateplace.php...

CVE-2023-6884

This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'placeid' attribute. This makes it possible for authenticated attackers with...

PT-2024-15119 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress plugin versions up to, and including, 3.1 Description: The plugin is vulnerable to Stored Cross-Site Scripting via its shortcode due to insufficient input sanitization and output escaping on the place id attribute. This allows...

WordPress Plugin Plugin for Google Reviews Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Malicious code in place-zip-autocomplete-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 80a9eda07bbcecc8a168b9ef0252e04b4b97abe222e5d8445113a1ae34c71a6d The OpenSSF Package Analysis project identified 'place-zip-autocomplete-input' @ 3.7.14 npm as malicious. It is considered malicious because: -...

RUSTSEC-2023-0096 Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...

Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...

Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Contact Google Place API...

Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Contact Google Place API" 2...

Malicious code in safe-place (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b80cbcb24e4f1807ee06fd72f2b7a227e474627d391ec40635927294aab3a8d6 The OpenSSF Package Analysis project identified 'safe-place' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8483 Malicious code in safe-place (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b80cbcb24e4f1807ee06fd72f2b7a227e474627d391ec40635927294aab3a8d6 The OpenSSF Package Analysis project identified 'safe-place' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2023-32331

Name of the Vulnerable Software and Affected Versions flusity CMS affected versions not specified Description A vulnerability was found in flusity CMS, classified as problematic, affecting the function loadCustomBlocCreateForm of the file /core/tools/customblock.php in the component Dashboard. Th...

flusity CMS Cross-Site Scripting Vulnerability

flusity CMS is a user interaction interface solution where code can be easily changed or added. A cross-site scripting vulnerability exists in flusity CMS, which stems from an issue with the loadCustomBlocCreateForm function in /core/tools/customblock.php in the component Dashboard, which leads t...

CVE-2023-42811

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. If a program using the aes-gcm...

AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails...