29225 matches found
CVE-2024-54225
CVE-2024-54225: WordPress Designer plugin (CodegearThemes Designer) contains a PHP Local File Inclusion due to improper filename control in include/require. Affected versions: Designer <= 1.3.3 (per NVD) with Wordfence listing Designer
MAL-2024-11426 Malicious code in programupdater (npm)
--- -= Per source details. Do not edit below this line.=-...
Eryaz NatraCar B2B Dealer Management Program å®å Øę¼ę“
Eryaz NatraCar B2B Dealer Management Program is a dealer management system from Eryaz. A security vulnerability exists in Eryaz NatraCar B2B Dealer Management Program that stems from improper use of special elements in SQL commands, resulting in a SQL injection vulnerability...
PT-2024-36975
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to an invalid access to prog array in perf event detach bpf prog. A crash occurs when a tracepoint perf event with attr.inherit=1 is created, attached to a process, and a b...
CVE-2024-11380
The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-11380 Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-11380 Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-11380
CVE-2024-11380 : The Mini Program API plugin for WordPress (versions ā¤ 1.4.5) is affected by a stored XSS in the qvideo shortcode due to insufficient input sanitization/output escaping of user attributes. This allows authenticated attackers with contributor-level access or higher to inject script...
PT-2024-16947 Ā· WordPress Ā· Mini Program Api
Name of the Vulnerable Software and Affected Versions: Mini Program API plugin for WordPress versions up to, and including, 1.4.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode due to insufficient input sanitization and output escaping on...
WordPress plugin Mini Program API č·Øē«čę¬ę¼ę“
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress Mini Program API plugin <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Mini Program API versions = 1.4.5...
CVE-2024-52558
The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program...
GHSA-9RMP-2568-59RV rPGP Panics on Malformed Untrusted Input
During a security audit, Radically Open Security discovered several reachable edge cases which allow an attacker to trigger rpgp crashes by providing crafted data. Impact When processing malformed input, rpgp can run into Rust panics which halt the program. This can happen in the following...
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 25, 2024 to December 1, 2024)
Time to wrap up this year and kick-off the new year with a bang! Weāre wrapping up the year with ourEnd of Year Holiday Extravaganza , High-Risk Bonus Blitz Challenge , and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025: All in-scope vulnerability types for...
runc: file descriptor leak
A file descriptor leak issue was found in the runc package. While a user performs OCLOEXEC all file descriptors before executing the container code, the file descriptor is open when performing setcwd2, which means that the reference can be kept alive in the container by configuring the working...
Regular Expression Denial Of Service (ReDoS)
cross-spawn is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to improper input sanitization, which allows an attacker to craft a large string that increases CPU usage and crashes the program...
Vulnerabilities Resolved in Veeam Backup & Replication 12.3
All vulnerabilities documented in this article were resolved in Veeam Backup & Replication 12.3. Veeam Product Latest Version Download Page Veeam Software Security Commitment VeeamĀ® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operat...
Intel Computing Improvement Program PyInstaller Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Intel Computing Improvement Program. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...
CVE-2024-53739
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects Cryptocurrency Widgets For Elementor: fr...
CVE-2024-53739 WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects Cryptocurrency Widgets For Elementor: fr...