CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390

The CVE-2024-45390 entry concerns the @blakeembrey/template string template library. Prior to version 1.2.0, there is a vulnerability where an attacker who can write the template name can inject and run code within the template. A patch was included in version 1.2.0. Remediation guidance from the...

WordPress Bold Timeline Lite Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Bold Timeline Lite Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43294 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 636116c40c53 Credits LVT-tholv2k Required privilege...

PT-2024-38377 · WordPress · Multipurpose

Name of the Vulnerable Software and Affected Versions: MultiPurpose theme for WordPress versions up to, and including, 1.2.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input through the wped...

WordPress MultiPurpose theme <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme Multipurpose versions = 1.2.0...

PYSEC-2024-265

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.This issue affects Apache Airflow Providers FAB: 1.2.1 when used with Apache Airflow 2.9.3 and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. FAB provider 1.2.1 only affected...

Apache Airflow 代码问题漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An Access Control Error vulnerability exists in Apache Airflow version 1.2.1 and...

WordPress Perfect Portfolio theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Perfect Portfolio versions = 1.2.0...

CVE-2024-35723

Missing Authorization vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through = 1.2.0...

CVE-2024-35723

Technical details about CVE-2024-35723 are not provided in the connected documents. The sources mention a Missing Authorization issue for Dashboard To-Do List up to 1.2.0, but no specifics on exploit vectors, impacts, or fixes.

CVE-2024-3166 Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm

A Cross-Site Scripting XSS vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, whic...

CVE-2024-3166

Summary: CVE-2024-3166 affects mintplex-labs/anything-llm, including desktop v1.2.0 to v1.4.1 and the web app. The vulnerability is an XSS in the feature that fetches and embeds external website content into workspaces, with a route to Remote Code Execution in the desktop app due to Electron sett...

CVE-2024-5345

CVE-2024-5345 affects the WordPress plugin Responsive Owl Carousel for Elementor. The vulnerability is a Local File Inclusion (LFI) in all versions up to 1.2.0, exploitable via the layout parameter. Authenticated attackers with Contributor-level access and above can cause the server to include an...

WordPress plugin Responsive Owl Carousel for Elementor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

WordPress plugin Sticky banner 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

WordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rayhan Ramdhany Hanaputra Patchstack Alliance in WordPress Plugin Sticky banner versions = 1.2.0...

PT-2024-26213 · Unknown +2 · Integration For Pipedrive/Contact Form 7 +3

Name of the Vulnerable Software and Affected Versions: Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms versions 1.2.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to perform...

PT-2024-22282 · F5 · F5 Big-Ip Next Cnf

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP Next CNF versions 1.2.0 through 1.2.1 Description: Exposure of Sensitive Information issue exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Recommendations: For...

PT-2024-25840 · Unknown · Chatbot Conversational Forms

Name of the Vulnerable Software and Affected Versions: Conversational Forms for ChatBot versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

WordPress ChatBot Conversational Forms plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jean Tirstan T Patchstack Alliance in WordPress Plugin Conversational Forms for ChatBot versions = 1.2.0...