CVE-2024-56015

CVE-2024-56015 concerns a CSRF vulnerability in the Tidy Up WordPress plugin by John Godley that enables a reflected XSS. Public details in the connected Red Hat entry describe the issue as a CSRF vulnerability that allows reflected XSS, affecting versions from unknown public release up to 1.3. T...

WordPress Tidy Up Plugin <= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerability

CSRF to Reflected Cross-Site Scripting vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Tidy Up versions = 1.3...

PT-2024-36668 · Tidy Up · Tidy Up

Name of the Vulnerable Software and Affected Versions: Tidy Up versions n/a through 1.3 Description: A Cross-Site Request Forgery CSRF issue allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. The...

WordPress plugin Tidy Up 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Astra Linux – Vulnerability in tidy-html5

A vulnerability in HTACG HTML Tidy v5.7.28 allows attackers to execute arbitrary code through the -g option of the CleanNode function in gdoc.c...

CVE-2024-9357 xili-tidy-tags <= 1.12.04 - Reflected Cross-Site Scripting

The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.04 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-9357 xili-tidy-tags <= 1.12.04 - Reflected Cross-Site Scripting

The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.04 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress xili-tidy-tags plugin <= 1.12.04 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin xili-tidy-tags versions = 1.12.04...

WordPress xili-tidy-tags Plugin <= 1.12.04 is vulnerable to Cross Site Scripting (XSS)

Software xili-tidy-tags Type Plugin Vulnerable versions = 1.12.04 Fixed in 1.12.05 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9357 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b09fba83740 Credits vgo0 Required...

WordPress plugin xili-tidy-tags 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

PYSEC-2024-238

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints includ...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

CVE-2023-49793

CVE-2023-49793 describes a path traversal in CodeChecker server via the massStoreRun endpoint (CodeCheckerService). ZIPs uploaded to CodeChecker store are not sanitized, allowing reading files from the server with the same permissions as the CodeChecker server. Attack requires a CodeChecker user ...

Fedora: Security Advisory for rust-clang-tidy-sarif (FEDORA-2024-40ee18b2e7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : tidy (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - tidy: heap buffer overflow in ParseValue CVE-2015-5522, CVE-2015-5523 Note that Nessus has not tested for...

[SECURITY] Fedora 39 Update: rust-clang-tidy-sarif-0.4.2-2.fc39

Convert clang-tidy output to SARIF...

Fedora: Security Advisory for rust-clang-tidy-sarif (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: rust-clang-tidy-sarif-0.4.2-3.fc40

Convert clang-tidy output to SARIF...

GHSA-F6MM-5FC7-3G3C goreleaser shows environment by default

Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...