Alt Text AI – Automatically generate image alt text for SEO and accessibility < 1.5.0 - Authenticated (Subscriber+) SQL Injection

Description The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack...

WordPress Download Alt Text AI Plugin <= 1.4.9 is vulnerable to SQL Injection

Software Download Alt Text AI Type Plugin Vulnerable versions = 1.4.9 Fixed in 1.5.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4847 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 156a5d33530e Credits Lucio Sá Required privilege Subscriber...

Directus allows redacted data extraction on the API through "alias"

Summary A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the alias functionality on the API. Normally, these redacted fields will return however if we change the request to ?aliasworkaround=redacted we can instead retrieve the...

The vulnerability of the User Plane Location (SUPL) message handler in the Telit Cinterion modem software allows a perpetrator to execute arbitrary code.

The vulnerability of the User Plane Location SUPL message handler in Telit Cinterion modem software is related to buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted SMS message...

The vulnerability of Unitronics Vision’s microprogrammed logic controllers, related to the storage of passwords in a recoverable format, allows a hacker to obtain the “Information Mode” password in plain text.

The vulnerability of the microprogrammed logic controllers from Unitronics Vision relates to the storage of passwords in a recoverable format. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain the “Information Mode” password in plain text...

RHEL 8 : golang.org_x_text (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag CVE-2020-28852 - The...

RHEL 6 : thunderbird (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - thunderbird: Memory corruption when processing S/MIME messages CVE-2021-43529 - thunderbird: Crafted emai...

RHEL 8 : developer_environment (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Developer environment: Homoglyph characters can lead to trojan source attack CVE-2021-42694 - An issue wa...

CVE-2024-4425

CVE-2024-4425 affects CemiPark software (versions 4.5, 4.7, 5.03 and potentially others). The root cause is improper handling of credentials, with integration credentials (e.g., FTP or SIP) stored in plain-text. An attacker who gains unauthorized access to the device can retrieve clear-text passw...

PT-2024-30517 · WordPress · Rank Math Seo

Name of the Vulnerable Software and Affected Versions: Rank Math SEO with AI Best SEO Tools plugin for WordPress versions up to, and including, 1.0.217 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the...

PT-2024-31076 · Cemipark · Cemipark

Name of the Vulnerable Software and Affected Versions: CemiPark software versions 4.5 through 5.03 Description: The access control in CemiPark software stores integration credentials, such as FTP or SIP, in plain-text. An attacker who gains unauthorized access to the device can retrieve clear tex...

PT-2024-22825 · WordPress · Magical Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Magical Addons For Elementor plugin versions up to, and including, 1.1.37 Description: The issue is related to Stored Cross-Site Scripting via the plugin's text effect widget due to insufficient input sanitization and output escaping on...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

PT-2024-22654 · Dell · Dell Update Manager Plugin

Name of the Vulnerable Software and Affected Versions: Dell Update Manager Plugin versions 1.4.0 through 1.5.0 Description: The issue concerns a Plain-text Password Storage Vulnerability in the log file of the Dell Update Manager Plugin. A remote high privileged attacker could potentially exploit...

CVE-2021-34958

Foxit PDF Editor Text Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2021-34958 Foxit PDF Editor Text Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Editor Text Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a...

@caedman/arma (>=0.1.18, <=0.1.87), @caedman/armdda (>=0.1.85, <=1.1.89) +17 more potentially affected by CVE-2024-34341 +1 more via trix (>=0.9.1, <=1.3.1)

trix NPM version =0.9.1, =0.1.18, =0.1.85, =0.0.1, =0.1.0, =0.2.0, =0.1.7, =7.8.0, =0.1.0, =1.0.0, =0.0.2, =3.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2024-34341, CVE-2024-43368 Source advisory: OSV:GHSA-QJQP-XR96-CJ99...