CVE-2022-42974: Improper Neutralization of Input During Web Page Generation

In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting XSS attack on /file.bootloader.upload.html. The application fails to sanitize the parameter filename, in a POST request to /file.bootloader.upload.html for a system...

CVE-2024-5344: Improper Neutralization of Input During Web Page Generation

The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping...

CVE-2024-5455: Improper Control of Filename for Include/Require Statement in PHP Program

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazinestyle' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level...

WordPress The Plus Addons for Elementor plugin <= 5.5.6 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by wesley wcraft in WordPress Plugin The Plus Addons for Elementor Pro versions = 5.5.6...

WordPress The Plus Addons for Elementor Page Builder plugin <= 5.5.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin The Plus Addons for Elementor Pro versions = 5.5.6...

WordPress WP Blog Post Layouts plugin <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by stealthcopter in WordPress Plugin WP Blog Post Layouts versions = 1.1.3...

WordPress The Plus Addons for Elementor Pro Plugin <= 5.5.6 is vulnerable to Cross Site Scripting (XSS)

Software The Plus Addons for Elementor Pro Type Plugin Vulnerable versions = 5.5.6 Fixed in 5.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5344 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 01ee398507f7 Credits...

PT-2024-36387 · WordPress · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: Plus Addons for Elementor Page Builder plugin for WordPress versions up to, and including, 5.5.4 Description: The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the...

WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ Shortcode Cross Site Scripting (XSS) vulnerability

Contributor+ Shortcode Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Page Builder: Live Composer versions = 1.5.42...

OPENSUSE-SU-2024:11192-1 prboom-plus-2.6.1um-1.2 on GA media

These are all security issues fixed in the prboom-plus-2.6.1um-1.2 package on the GA media of openSUSE Tumbleweed...

PT-2024-8782

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to the file auditing configuration, where the lack of protection of the SQL query structure allows for authenticated SQL injection. This can enable a...

PT-2024-8780 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to a lack of protection of the SQL query structure in the Windows Active Directory management and reporting tool. This can allow a remote attacker to...

PT-2024-8781 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to a lack of protection in the SQL query structure, which can be exploited to execute custom queries and gain access to database table records. This is a...

Number withdrawn

GNU gdb is a GNU project debugger from the American GNU community. It supports debugging C, C++, Pascal, and FORTRAN programming languages. This CVE number has been withdrawn...

HPESBHF04638 rev.1 - Certain HPE ProLiant Servers Using Certain AMD EPYC Processors, AMD-SB-1041: SPI Lock Bypass, Local Arbitrary Code Execution Vulnerability

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL325 Gen10 Plus server - Prior to v3.1005-16-2024 HPE ProLiant DL325 Gen10 Plus v2 server - Prior to v3.1005-16-2024 HPE ProLiant DL345 Gen10 Plus server - Prio...

CVE-2024-33572

Missing Authorization vulnerability in POSIMYTH The Plus Blocks for Block Editor | Gutenberg.This issue affects The Plus Blocks for Block Editor | Gutenberg: from n/a through 3.2.5...

CVE-2024-33572

Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a through = 3.2.5...

CVE-2024-33572

CVE-2024-33572 is a Missing Authorization/Broken Access Control vulnerability in WordPress plugin The Plus Blocks for Block Editor (Gutenberg) for versions up to and including 3.2.5. The advisory notes that upgrading to a version later than 3.2.5 remediates the issue. Public sources show a CVSS b...

CVE-2024-33572 WordPress The Plus Blocks for Block Editor | Gutenberg plugin <= 3.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in POSIMYTH The Plus Blocks for Block Editor | Gutenberg.This issue affects The Plus Blocks for Block Editor | Gutenberg: from n/a through 3.2.5...

CVE-2024-33572 WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a through = 3.2.5...