1384 matches found
CVE-2024-1664
The Responsive Gallery Grid WordPress plugin, in versions prior to 2.3.11 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS at...
CVE-2024-0082
CVE-2024-0082 (NVIDIA ChatRTX for Windows) affects NVIDIA ChatRTX for Windows, describing a vulnerability in the UI that allows an attacker to cause improper privilege management by sending open file requests to the application, potentially enabling local privilege escalation, information disclos...
CVE-2024-1752
The Font Farsi WordPress plugin (versions 1.6.6 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitise and escape certain settings before they are displayed back on the page. This allows high-privilege users, such as administrators , to...
CVE-2024-1589
The SendPress Newsletters WordPress plugin (versions  into these parameters. Remediation requires updating the plugin to a version later than 1.23.11.6 . As a temporary workaround, administrators should restrict access to the plugin's settings.
CVE-2024-1292
The WPB Show Core WordPress plugin versions prior to 2.7 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape certain parameters before outputting them back to the page. This vulnerability could be exploited against high-privilege users , su...
CVE-2024-2132
CVE-2024-2132 affects the Ultimate Bootstrap Elements for Elementor WordPress plugin. Root cause: Stored XSS via the Image Widget due to insufficient input sanitization and output escaping of user-supplied attributes. Impact (as described in connected RH entry): authenticated attackers with contr...
CVE-2024-2444
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-2509
The Gutenberg Blocks by Kadence Blocks WordPress plugin (versions before 3.2.26 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly validate and escape certain block options before they are rendered in a page or post where the block is embedded...
CVE-2024-30250
Astro-Shield (KindSpells) vulnerability CVE-2024-30250 affects versions 1.2.0–1.3.1, where injecting a correct SRI attribute into code causes the injected resource to be considered legitimate by CSP, enabling bypass of cross-origin allow-lists. Root cause: the SRI hash is added to the CSP header,...
CVE-2024-22189
The CVE concerns quic-go prior to v0.42.0 where an attacker can cause memory exhaustion on the peer by flooding with NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is expected to reply with RETIRE_CONNECTION_ID frames for each retirement; an attacker can prevent most of the...
CVE-2024-22360
CVE-2024-22360 (IBM Db2 on Cloud Pak for Data) is a denial-of-service issue triggered by a specially crafted query on certain columnar tables. Affected products include IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, with versions listed as v3.5 through various refresh leve...
CVE-2024-27254
CVE-2024-27254 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (versions in the 3.0/4.x line as listed in the remediation table) with a denial-of-service condition from a specially crafted query. The connected Red Hat entry confirms the vulnerability details and scop...
CVE-2024-27191
CVE-2024-27191 concerns the WordPress plugin Slivery Extender (Inpersttion Slivery Extender). Public sources describe an "ImpropER Control of Generation of Code (Code Injection)" vulnerability that enables an authenticated attacker (Contributor+) to execute arbitrary code via the plugin’s shortco...
CVE-2024-28782
IBM CVE-2024-28782 affects IBM QRadar Suite Software and IBM Cloud Pak for Security: QRadar Suite 1.10.12.0–1.10.18.0 and Cloud Pak for Security 1.10.0.0–1.10.11.0 store user credentials in plain clear text readable by an authenticated user. Root cause is plaintext credential storage, enabling in...
CVE-2024-28219
CVE-2024-28219 affects the Pillow Python imaging library. In _imagingcms.c, a buffer overflow was introduced because strcpy was used instead of a safer copy like strncpy, impacting Pillow before version 10.3.0. The issue filename and function indicate a likely overflow related to fixed-length str...
CVE-2023-35812
CVE-2023-35812 affects OpenSSH 7.4 in Amazon Linux 1/2. The issue stems from an incomplete mitigation for CVE-2019-6111: when a relative path is used with scp, the client does not verify that the received filename matches the requested one, allowing potential file misassociation. Public advisorie...
CVE-2024-30173
CVE-2024-30173 maps to an authentication bypass in the TYPO3 OpenID Connect Authentication extension. The TYPO3 extension’s authentication service does not verify the OpenID Connect authentication state from the user lookup chain and instead authenticates every valid frontend user whose tx_oidc f...
CVE-2023-50960
IBM QRadar SIEM is vulnerable to CVE-2023-50960, a stored cross-site scripting flaw in the Web UI. The IBM bulletin specifies affected product: IBM QRadar SIEM 7.5.0 UP7, with fix in 7.5.0 UP8; exploitation details are not provided beyond the stored XSS description, and the impact is potential cr...
CVE-2024-24883
CVE-2024-24883 affects BdThemes Prime Slider – Addons For Elementor (WordPress). Affected versions: up to 3.11.10. Root cause: missing authorization check in bdt_duplicate_as_draft() allows authenticated users with contributor-level access and above to duplicate private/password-protected posts. ...