CVE-2024-47080

CVE-2024-47080 affects matrix-js-sdk (Matrix Client-Server SDK for JavaScript/TypeScript). In versions 9.11.0–34.7.0, MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers because it unconditionally sends shared history keys to all invited devices, regardless o...

PT-2024-11908

Name of the Vulnerable Software and Affected Versions Sassy Social Share plugin for WordPress versions up to, and including, 3.3.3 Description The issue is related to Reflected Cross-Site Scripting via the urls parameter called via the heateor sss sharing count AJAX action due to insufficient inp...

WordPress Social Sharing (by Danny) plugin <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Social Sharing by Danny versions = 1.3.7...

WordPress Social Sharing (by Danny) Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Social Sharing by Danny Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9704 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 88d510b46b3a Credits Peter Thaleikis...

CVE-2024-9704

The Social Sharing by Danny plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvksocialsharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-9704

CVE-2024-9704 refers to the WordPress Social Sharing (by Danny) plugin, vulnerable up to version 1.3.7. Root cause: insufficient input sanitization and output escaping on the dvk_social_sharing shortcode, enabling stored XSS. Impact: authenticated users with contributor-level access and above can...

SUSE CVE-2024-47867

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is...

WordPress plugin Social Sharing 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-39771 · WordPress · Social Sharing

Name of the Vulnerable Software and Affected Versions: Social Sharing by Danny plugin for WordPress versions up to, and including, 1.3.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the dvk social sharing shortcode. This...

CVE-2024-47867 Lack of integrity check on the downloaded FRP client in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is...

CVE-2024-47867 Lack of integrity check on the downloaded FRP client in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is...

Resources Downloaded over Insecure Protocol

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol due to the lack of integrity checking on the downloaded FRP client. An attacker can introduce malicious...

Security Bulletin: IBM DevOps Velocity is vulnerable due to multiple misconfigurations

Summary Multiple vulnerabilities in IBM DevOps Velocity have been address in IBM DevOps Velocity version 5.0.1 Vulnerability Details CVEID:CVE-2024-22348 DESCRIPTION: IBM UCV - UrbanCode Velocity uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions...

OPENSUSE-SU-2024:0329-1 Security update for seamonkey

This update for seamonkey fixes the following issues: update to SeaMonkey 2.53.19: Cancel button in SeaMonkey bookmarking star ui not working bug 1872623. Remove OfflineAppCacheHelper.jsm copy from SeaMonkey and use the one in toolkit bug 1896292. Remove obsolete registerFactoryLocation calls fro...

5 Must-Have Tools for Effective Dynamic Malware Analysis

Dynamic malware analysis is a key part of any threat investigation. It involves executing a sample of a malicious program in the isolated environment of a malware sandbox to monitor its behavior and gather actionable indicators. Effective analysis must be fast, in-depth, and precise. These five...

Synology DiskStation Manager Injection (CVE-2021-29085)

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in file sharing management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors. This plugin only...

CVE-2024-34542

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process...

The vulnerability of Flask’s CORS storage library in Python PyPi products allows attackers to circumvent existing security restrictions.

The vulnerability of Flask’s CORS storage library in Python PyPi products is related to incorrect handling of logical operations. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely, leading to unexpected implementation of CORS policies...

The vulnerability of the CORS mechanism implementation in Python PyPi storage solutions allows attackers to disclose protected information.

The vulnerability of the CORS mechanism implemented in Python PyPi software repositories is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

The vulnerability of the CORS mechanism implementation in Python PyPi storage solutions allows attackers to disclose protected information.

The vulnerability of the CORS mechanism implemented in Python PyPi software repositories is related to improper resolution of path equivalence. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...