OESA-2024-1340 gstreamer1-plugins-base security update

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin. Security Fixes: Heap-based buffer overflow in the subparse subtitle parser when handling certain SRT subtitle files in GStreamer versions before 1.22....

BIT-MEDIAWIKI-2024-23179

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks...

openSUSE: Security Advisory for gstreamer (SUSE-SU-2023:3249-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-1398

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headingtitletag’ and ’headingsubtitletag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it...

WordPress Plugin Ultimate Bootstrap Elements for Elementor Security Breach

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-24512

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

CVE-2024-24512

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

Cross site scripting

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

PKP OPEN JOURNAL SYSTEMS Cross-Site Scripting Vulnerability

PKP OPEN JOURNAL SYSTEMS PKP OJS is an end-to-end scholarly publishing platform from PKP Inc. A cross-site scripting vulnerability exists in PKP OPEN JOURNAL SYSTEMS v3.4 that originates from allowing an attacker to execute arbitrary code via the input subtitle component...

CVE-2024-24512: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

CVE-2024-24512

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

PT-2024-20431 · Public Knowledge · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: Pkp OJS version 3.4 Description: The issue allows an attacker to execute arbitrary code via the input subtitle component. This is a Cross Site Scripting vulnerability. Recommendations: For Pkp OJS version 3.4, consider disabling the input...

CVE-2024-23179

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks...

Fedora 38 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2023-0984b63b23)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-0984b63b23 advisory. Update to 1.22.7, fixes CVE-2023-37327, CVE-2023-37328, CVE-2023-37329. Tenable has extracted the preceding description block directly from the Fedo...

OESA-2023-1943 gstreamer1-plugins-bad-free security update

GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good...

CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

CVE-2023-50265

Bazarr prior to 1.3.1 contains an arbitrary file read in /api/swaggerui/static because the user‑supplied filename is passed to send_file in bazarr/app/ui.py without validation. Affects Bazarr versions before 1.3.1; fixed in 1.3.1. Impact: potential read of arbitrary files on the server. Remediati...

CVE-2023-50264

CVE-2023-50264 affects Bazarr prior to v1.3.1, where the /system/backup/download/ endpoint in bazarr/app/ui.py reads a user-controlled filename without validation and passes it to send_file, enabling arbitrary file read on the system. The issue is confirmed by multiple sources and is fixed in ver...

CVE-2023-37329

A heap-based buffer overflow vulnerability was found in the PGS Blu-ray subtitle decoder within GStreamer when processing specific files. This issue could allow a malicious third party to crash the application and execute code by manipulating the heap. Mitigation Mitigation for this issue is eith...

CVE-2023-37328

A heap-based buffer overflow was found in the subparse subtitle parser of GStreamer when processing specific SRT subtitle files. This issue could allow a malicious third party to crash the application and execute code through manipulation of the heap. Mitigation Mitigation for this issue is eithe...