CVE-2024-4627 Rank Math SEO < 1.0.219 - Authenticated Stored XSS

The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin...

CVE-2024-4627

CVE-2024-4627 affects Rank Math SEO for WordPress prior to 1.0.219. It is an authenticated Stored XSS due to insufficient sanitisation/escaping of settings, exploitable by users with access to General Settings (admin by default, but grantable via Role Manager in

WordPress Sina Extension for Elementor plugin <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via readmoretext Parameter vulnerability discovered by stealthcopter in WordPress Plugin Sina Extension for Elementor versions = 3.5.5...

SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / kubevirt-tests / etc (SUSE-SU-2024:2246-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2246-1 advisory. - Collect component Role rules under operator Role instead of ClusterRole bsc1223965, CVE-2024-33394 - Ensure procps is...

CVE-2024-4934 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

...

SUSE-SU-2024:2246-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: - Colle...

CVE-2024-38518 bbb-web API additional parameters considered

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an...

CVE-2024-38518

BigBlueButton (BBB) is affected. A valid join link can be manipulated to generate a signed join link with extra parameters (for example role=moderator), allowing an attacker to join a meeting as moderator using a link intended for viewers. This vulnerability is addressed in BBB versions 2.6.18, 2...

GO-2024-2594 Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server

Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

CVE-2024-1330

Kadence Blocks Pro for WordPress

CVE-2024-1330 Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access

The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database...

CVE-2024-1330 Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access

The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database...

WordPress Plugin Kadence Blocks Pro Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-5199 Spotify Play Button <= 1.0 - Contributor+ Stored XSS

The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-3633

CVE-2024-3633 affects the WordPress plugin WebP & SVG Support (versions ≤ 1.4.0). The issue is that uploaded SVG files are not sanitised, enabling a user with Author+ privileges to upload a malicious SVG containing XSS payloads. The CVSSv3 base score is 5.4 (Medium). The vulnerability is mitigate...

CVE-2024-4759 Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload

The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-4759 Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload

The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

PT-2024-32665 · WordPress · Mime Types Extended

Name of the Vulnerable Software and Affected Versions: Mime Types Extended WordPress plugin versions through 0.11 Description: The issue concerns the Mime Types Extended WordPress plugin, which fails to sanitize uploaded SVG files. This could allow users with a role as low as Author to upload...

PT-2024-5800 · Openvpn +6 · Openvpn +6

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.0 through 2.6.10 Description: The issue is related to OpenVPN's handling of exit notifications from authenticated clients in a server role. When multiple exit notifications are accepted, it can extend the validity of a...