CVE-2024-10014

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10014

CVE-2024-10014 – Flat UI Button (WordPress) XSS Affected: Flat UI Button plugin for WordPress, version 1.0 and earlier. Root cause: Insufficient input sanitization and output escaping on user-supplied attributes within the flatbtn shortcode. Impact: Stored Cross‑Site Scripting that can execute ar...

WordPress plugin Flat UI Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-30875

A Cross-site scripting XSS vulnerability was found in the jquery-ui library. If a user visits a malicious website, a remote attacker may be able to obtain sensitive information and execute arbitrary code via a specially crafted payload to the window.addEventListener component. Mitigation Mitigati...

CVE-2024-30875

Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component. NOTE: this is disputed by the Supplier because it cannot be reproduced, a...

CVE-2024-30875

Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component...

WordPress Flat UI Button plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via flatbtn Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Flat UI Button versions 1.0...

Malicious code in @safecorp/one-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9e0af8fba7ea4479d8e7a1cf1095346b605e9a718d6fd663ad9ee38130d12d6d The OpenSSF Package Analysis project identified '@safecorp/one-ui' @ 10.10.10 npm as malicious. It is considered malicious because: - The packag...

Chromium: CVE-2024-9957 Use after free in UI

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE CVE-2024-9957

Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9958

Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9961

Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9962

Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9963

Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-9964

Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

SUSE CVE-2024-9965

Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: Low...

CVE-2024-30875

CVE-2024-30875 affects jquery-ui v1.13.1 with a Cross-Site Scripting (XSS) vulnerability via the window.addEventListener component. IBM’s bulletin confirms the issue and lists affected IBM Robotic Process Automation products, with remediation paths to update to 21.0.7.19+ or 23.0.20+ (Cloud Pak a...

WordPress Flat UI Button Plugin 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Flat UI Button Type Plugin Vulnerable versions 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10014 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 35d97ede67c1 Credits Francesco Carlucci Required...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2024-43188)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

Unspecified Vulnerability in Google Chrome (CNVD-2024-44479)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 130.0.6723.58, which stems from an improper implementation of PictureInPicture, and can be exploited by remote attackers to perform UI spoofing via a crafted HTML pag...