WordPress FV Flowplayer Video Player Plugin <= 7.5.44.7212 is vulnerable to Unvalidated Redirects and Forwards

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.44.7212 Fixed in 7.5.45.7212 OWASP Top 10 A3: Injection Classification Unvalidated Redirects and Forwards CVE CVE-2024-32078 Patch priority Low CVSS severity Low 4.1 Developer Claim ownership PSID cc8148fa1127 Credits...

CVE-2023-6385

The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs...

UNISOC Chipsets 安全漏洞

UNISOC Chipsets is a chipset from China's Purple Spreadtrum UNISOC. A security vulnerability exists in UNISOC Chipsets, which stems from a possible incorrect input in the vsp driver that lacks validation...

CVE-2024-31950

In FRRouting FRR through 9.1, there can be a buffer overflow and daemon crash in ospfteparseri for OSPF LSA packets during an attempt to read Segment Routing subTLVs their size is not validated...

DEBIAN-CVE-2024-31951

In the Opaque LSA Extended Link parser in FRRouting FRR through 9.1, there can be a buffer overflow and daemon crash in ospfteparseextlink for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs lengths are not validated...

The vulnerability of the `on_receive_session_packet_ack` function in the `libv2_sdk.so` library of DJI’s quadrocopters—such as the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, DJI Mavic Mini 3 Pro—allows a intruder to disclose protected information or execute arbitrary code.

The vulnerability of the onreceivesessionpacketack function in the libv2sdk.so library of DJI’s quadrocopters, such as the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, and DJI Mavic Mini 3 Pro, is related to unvalidated array indexin...

DerbyNet 9.0 ajax/query.slide.next.inc SQL Injection

CVE ID: CVE-2024-30928 Description: An SQL Injection vulnerability has been discovered in DerbyNet version 9.0, particularly within the ajax/query.slide.next.inc file. This vulnerability allows remote attackers to execute arbitrary code and disclose sensitive information by exploiting the...

WordPress plugin Gutenberg Blocks by Kadence Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

Kofax Power PDF 安全漏洞

Kofax Power PDF is a professional PDF editing and management software from Kofax. A security vulnerability exists in Kofax Power PDF that stems from a specific flaw in the parsing of PDF files that lacks proper validation of user-supplied data, allowing a remote attacker to execute arbitrary code...

Foxit PDF Reader 安全漏洞

Foxit PDF Reader is Foxit's first simplified Chinese version of the PDF document reader. A remote code execution vulnerability exists in Foxit PDF Reader. The vulnerability is related to the handling of AcroForms and is caused by failing to validate an object before performing an operation on it...

Node.js Module node-tar < 6.2.1 DoS

In the nodejs module node-tar prior to version 6.2.1, there is no validation of the number of folders created while unpacking a file. As a result, an attacker can use a malicious file to exhaust the CPU and memory on the host and crash the nodejs client. Note that Nessus has not tested for these...

CVE-2024-0711

The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

FusionPBX Security Vulnerabilities

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conferencing server and voice application server. A security vulnerability exists in FusionPBX versions prior to 5.2.0 that stems from the...

WordPress Plugin Team Members Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Otter Blocks < 2.6.5 - Contributor+ Stored Cross-Site Scripting

Description The plugin does not validate and escape its id block parameter before outputting it back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

PT-2024-17948 · WordPress · Team Members

Name of the Vulnerable Software and Affected Versions: The Team Members WordPress plugin versions prior to 5.3.2 Description: The issue is related to the lack of validation and escaping of some shortcode attributes in the plugin, which could allow users with the author role and above to perform...

WordPress Plugin Jobs Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-7007

Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field...

WordPress Plugin User Shortcodes Plus Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-0559

The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...