WordPress Template Kit – Export plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mahesh Nagabhairava Patchstack Alliance in WordPress Plugin Template Kit – Export versions = 1.0.23...

WordPress Template Kit – Export Plugin <= 1.0.23 is vulnerable to Cross Site Scripting (XSS)

Software Template Kit – Export Type Plugin Vulnerable versions = 1.0.23 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37550 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 393ac04c5e97 Credits Mahesh Nagabhairava Required...

CVE-2024-39691 Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when...

The vulnerability of the libavcodec/cbs_h266_syntax_template.c file in the multimedia library FFmpeg allows a hacker to execute arbitrary code.

The vulnerability in the libavcodec/cbsh266syntaxtemplate.c file of the multimedia library FFmpeg is related to unvalidated array indexing. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2024-6470

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=featureinboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input id...

CVE-2024-6470 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=featureinboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input id...

CVE-2024-6470 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=featureinboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input id...

CVE-2024-6470 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=featureinboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input id...

CVE-2024-6469

A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=featurefirewall&op=firewalllist of the component Template Handler. The manipulation of the argument IP address with the...

CVE-2024-6469 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=featurefirewall&op=firewalllist of the component Template Handler. The manipulation of the argument IP address with the...

CVE-2024-6469 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=featurefirewall&op=firewalllist of the component Template Handler. The manipulation of the argument IP address with the...

CVE-2024-6469 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=featurefirewall&op=firewalllist of the component Template Handler. The manipulation of the argument IP address with the...

PT-2024-37651 · Playsms · Playsms

Name of the Vulnerable Software and Affected Versions: playSMS version 1.4.3 Description: A vulnerability was found in the Template Handler component of playSMS, affecting some unknown functionality of the file /index.php?app=main&inc=feature inboxgroup&op=list. The manipulation of the id argumen...

playSMS Injection Vulnerability

playSMS is an open source SMS Short Message Service management software from Anton Raharja, an individual developer in India. An injection vulnerability exists in playSMS version 1.4.3, which stems from an issue in the /index.php?app=main&inc=featureinboxgroup&op=list file of the Template Handler...

playSMS Injection Vulnerability

playSMS is an open source SMS Short Message Service management software from Anton Raharja, an individual developer in India. An injection vulnerability exists in playSMS version 1.4.3, which stems from an issue in the /index.php?app=main&inc=featurefirewall&op=firewalllist file of the Template...

CBL Mariner 2.0 Security Update: ansible (CVE-2023-5764)

The version of ansible installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5764 advisory. - A template injection flaw was found in Ansible where a user's controller internal templating operations May...

PT-2024-37650 · Playsms · Playsms

Name of the Vulnerable Software and Affected Versions: playSMS version 1.4.3 Description: A vulnerability was found in the Template Handler component, specifically in the file /index.php?app=main&inc=feature firewall&op=firewall list. The manipulation of the id argument leads to injection. The...

yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

GHSA-79W7-VH3H-8G4J yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

UBUNTU-CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...