PT-2024-26328 · WordPress · The Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks – WordPress Blocks Plugin versions up to, and including, 3.1.9 Description: The issue is related to Stored Cross-Site Scripting via the title tag parameter due to insufficient input sanitization and output escaping. This...

PT-2024-18037 · Unknown · The Post Grid – Shortcode

Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting via the section title tag attribute due to insufficient...

WordPress plugin Ultimate Blocks security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

BIT-GITLAB-2024-2191 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only...

Exploit for Cross-site Scripting in Fikeulous Simpcms

Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS C...

Malicious code in down_load_ebook_se_incontri_il_buddha_per_strada_uccidilo_by_sheldon_b_kopp_0gwqq (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in down_load_ebook_maqtal_hossein_tragedin_i_karbala_by_den_vantades_vanner_4ulx6 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in accion-devolucions-john-wick-keanu-reeves-accion-en-casa-la-mejor-neova-pelicula-publicada--en-casa-en-lienia-lliena-love (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in 5.7m-views-in-boots-the-last-wish-2023-full-online-free-on-streaming-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in 1.7m-views-in-boots-the-last-wish-2023-full-online-free-on-streaming-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress Robo Gallery plugin <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title vulnerability discovered by Tim Coen in WordPress Plugin Robo Gallery versions = 3.2.19...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

iTerm2 Security Vulnerability

iTerm2 is a terminal emulation program written for Mac OS X. A security vulnerability in iTerm2 version 3.5.x prior to 3.5.2, which originates from the unfiltered use of escape sequences to report window titles, allows an attacker to inject arbitrary code into the terminal...

CVE-2024-38395

CVE-2024-38395 affects iTerm2 before 3.5.2: the Terminal may report window title setting is not honored, which could allow remote code execution. Noted as not trivially exploitable. A fix is available in iTerm2 3.5.2 (see GitLab tag v3.5.2); upgrade to mitigate. The connected data also documents ...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

PT-2024-27980 · Iterm2 · Iterm2

Name of the Vulnerable Software and Affected Versions: iTerm2 versions 3.5.x through 3.5.1 Description: An issue was discovered in iTerm2 that allows an attacker to inject arbitrary code into the terminal by abusing title reporting and tmux integration. This is possible due to the unfiltered use ...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

CVE-2024-5858 Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update

The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcldopenaititlegeneratedesc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2024-27891 · WordPress · Tagdiv Composer

Name of the Vulnerable Software and Affected Versions: tagDiv Composer plugin for WordPress versions up to, and including, 4.8 Description: The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the 'td block...