2362 matches found
CVE-2024-2845
CVE-2024-2845 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg” up to and including version 3.4.2. The Red Hat and Wordfence entries describe the flaw...
CVE-2024-2200
The CVE CVE-2024-2200 concerns WordPress plugin Contact Form by BestWebSoft. Affected versions: all up to and including 4.2.8. Root cause: insufficient input sanitization and output escaping leads to Reflected Cross-Site Scripting via the cntctfrm_contact_subject parameter. Impact: unauthenticate...
CVE-2024-1904
CVE-2024-1904 affects the MasterStudy LMS WordPress plugin (up to and including 3.2.13). The issue is a missing capability check in the search_posts function, allowing authenticated users with subscriber-level access or higher to view draft post titles and excerpts. Impact is unauthorized data ex...
CVE-2024-1637
The CVE-2024-1637 entry concerns the 360 Javascript Viewer WordPress plugin. Affected versions are all versions up to and including 1.7.12, where an unauthorized modification of data is possible due to a missing capability check and nonce exposure on multiple AJAX actions. The vulnerability can b...
CVE-2024-1974
CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...
CVE-2024-2185
CVE-2024-2185 concerns Beaver Builder Addons by WPZOOM for WordPress. Connected sources confirm a Stored XSS via the Image Box widget affecting versions up to 1.3.4 due to insufficient input sanitization/output escaping. Exploitation is reported to require at least Contributor+ authentication; th...
CVE-2024-0083
NVIDIA ChatRTX for Windows is affected by a UI-based cross-site scripting vulnerability (CVE-2024-0083) that can be triggered by network-delivered malicious scripts. The issue affects version 0.2 and earlier; exploitation could lead to code execution, denial of service, and information disclosure...
CVE-2024-1752
The Font Farsi WordPress plugin (versions 1.6.6 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitise and escape certain settings before they are displayed back on the page. This allows high-privilege users, such as administrators , to...
CVE-2024-1956
The wpb-show-core WordPress plugin, in versions prior to 2.7 , is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitise and escape parameters before outputting them in responses to unauthenticated requests . This flaw allows an attacker to e...
CVE-2024-1958
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users...
CVE-2024-1589
The SendPress Newsletters WordPress plugin (versions  into these parameters. Remediation requires updating the plugin to a version later than 1.23.11.6 . As a temporary workaround, administrators should restrict access to the plugin's settings.
CVE-2024-1292
The WPB Show Core WordPress plugin versions prior to 2.7 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape certain parameters before outputting them back to the page. This vulnerability could be exploited against high-privilege users , su...
CVE-2024-1588
The SendPress Newsletters WordPress plugin (versions Advanced . This flaw allows high-privilege users, such as administrators, to execute malicious scripts even when the unfiltered_html capability is disallowed (e.g., in a multisite setup). Practical exploitation involves injecting a payload like...
CVE-2024-2444
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2023-5973
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...
Truncated port name (CVE-2023-5973)
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display. Note: The vulnerability doesn...
CVE-2023-38729
CVE-2023-38729 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) across multiple releases. The vulnerability enables sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT. Affected versions include Db2 10.5, 11.1, and 11.5; exploitation details are t...
CVE-2024-27254
CVE-2024-27254 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (versions in the 3.0/4.x line as listed in the remediation table) with a denial-of-service condition from a specially crafted query. The connected Red Hat entry confirms the vulnerability details and scop...