Rich Code Execution

The vulnerability of the Rich Text Editor component in the Querybook big data processing environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

CVE-2024-3638: Improper Neutralization of Input During Web Page Generation

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on us...

WordPress plugin Elementor Addons by Livemesh security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Westermo EDW-100 Information Disclosure

The vulnerability of the microprogrammed industrial converter’s serial interface Ethernet implementation, the Westermo EDW-100, lies in the storage of passwords as plain-text files in the configuration file. Exploiting this vulnerability allows a malicious actor to obtain information about the...

PT-2024-31267

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor versions up to, and including, 5.6.1 Description The issue is related to Stored Cross-Site Scripting via the 'Countdown' widget due to insufficient input sanitization and output escaping on the user-supplied text...

firefox security update

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

CVE-2024-5260

The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘readmoretext’ parameter in all versions up to, and including, 3.5.5 due to insufficient...

CVE-2024-5260

The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘readmoretext’ parameter in all versions up to, and including, 3.5.5 due to insufficient...

WordPress Sina Extension for Elementor plugin <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via readmoretext Parameter vulnerability discovered by stealthcopter in WordPress Plugin Sina Extension for Elementor versions = 3.5.5...

Important: less security update

The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security Fixes: less: OS command injection...

WordPress plugin Sina Extension security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SkillTree Security Vulnerabilities

SkillTree is a micro-learning gamification platform open-sourced by the National Security Agency. Provides out-of-the-box UI visualization, a convenient client integration library, and a dashboard for managing the creation and management of gamified training profiles. A security vulnerability...

PT-2024-35396 · Unknown · Sina Extension For Elementor

Name of the Vulnerable Software and Affected Versions: Sina Extension for Elementor versions up to, and including, 3.5.5 Description: The issue is related to Stored Cross-Site Scripting via the read more text parameter due to insufficient input sanitization and output escaping. This allows...

MAL-2024-10172 Malicious code in text-adventure-game (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d130695c8c001b5c9dcdb269da4709b4b1d6f75407f319a7ed709f2370212fdd --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: text-adventure-game-ch-2024-07 Reasons based on the campaign:...

Malicious code in text-adventure-game (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d130695c8c001b5c9dcdb269da4709b4b1d6f75407f319a7ed709f2370212fdd --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: text-adventure-game-ch-2024-07 Reasons based on the campaign:...

CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-36422 GHSL-2023-245: Flowise xss in api/v1/chatflows/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the api/v1/chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to craft a...

GNU Emacs, Org Mode: Multiple Vulnerabilities

Background GNU Emacs is a highly extensible and customizable text editor. Description Multiple vulnerabilities have been discovered in GNU Emacs. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow related to the snippet feature.

...

SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases) aka Magellan.

...