WordPress Visual Composer Website Builder plugin <= 45.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Title

Authenticated Stored Cross-Site Scripting XSS vulnerability via Title discovered by Zhouyuan Yang in WordPress Visual Composer Website Builder plugin versions = 45.0. Solution Update the WordPress Visual Composer Website Builder plugin to the latest available version at least 45.0.1...

WordPress Visual Composer Website Builder plugin <= 45.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Text Block

Authenticated Stored Cross-Site Scripting XSS vulnerability via Text Block discovered by Zhouyuan Yang in WordPress Visual Composer Website Builder plugin versions = 45.0 Solution Update the WordPress Visual Composer Website Builder plugin to the latest available version at least 45.0.1...

The vulnerability of the Visual Composer browser-based modeling tool of the SAP NetWeaver software integration platform allows a perpetrator to escalate their privileges, execute arbitrary commands, or cause service interruptions.

The vulnerability of the Visual Composer browser-based modeling tool of the SAP NetWeaver software integration platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability can allow a remote attacker to enhance their privileges, execute arbitrary commands, or cau...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

CVE-2021-38163 affects SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30/7.31/7.40/7.50 with an unrestricted file upload path traversal that, when exploited by an authenticated non-administrative user, can trigger processing of a malicious file and execute OS commands under the Java Server pro...

WordPress 4k Icons for Visual Composer plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex in WordPress 4k Icons for Visual Composer plugin versions = 1.0. Solution This plugin has been closed and is no longer available for download...

CVE-2021-24244

An AJAX action registered by the WPBakery Page Builder Visual Composer Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options key, email...

CVE-2021-24244

CVE-2021-24244 affects the WPBakery Page Builder Clipboard Plugin for WordPress prior to version 4.5.8. The issue arises from an AJAX action registered by the Clipboard plugin that did not perform capability checks, enabling low-privilege users (e.g., subscribers) to update license options (key a...

CVE-2021-24243

CVE-2021-24243 affects the WPBakery Page Builder Clipboard WordPress plugin (before 4.5.6). The vulnerability arises from an AJAX action lacking capability checks and input sanitization, allowing low-privilege users (subscriber+) to submit crafted payloads that trigger XSS on all backend pages. P...

WordPress Visual Composer Website Builder plugin <= 26.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Multiple Cross-Site Scripting XSS vulnerabilities discovered by NinTechNet in WordPress Visual Composer Website Builder plugin versions = 26.0. Solution Update the WordPress Visual Composer Website Builder plugin to the latest available version at least 27.0...

Visual Composer < 27.0 - Multiple Authenticated Cross-Site Scripting Issues

Jerome Braundet from NinTechNet, discovered multiple Stored Cross-Site Scripting issues, which could allow users with the contributor and above roles to inject arbitrary JavaScript in the blog...

WordPress ND Shortcodes For Visual Composer plugin <= 5.8 - Unauthenticated WP Options Update vulnerability

Unauthenticated WP Options Update vulnerability found in WordPress ND Shortcodes For Visual Composer plugin versions = 5.8. Solution Update the WordPress ND Shortcodes For Visual Composer plugin to the latest available version at least 5.9.1...

SAP NetWeaver Visual Composer Remote Code Injection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote code injection vulnerability exists in SAP NetWeaver Visual Composer. An attacker could exploit the...

SAP Patch Tuesday Update Resolves 19 Flaws, Three High Severity

SAP released 19 patches on Tuesday, fixing a trio of vulnerabilities marked high severity in its business management software. The most pressing fixes are for a directory traversal vulnerability in the company’s Netweaver AS Java Web Container, a code injection vulnerability in its Visual Compose...

CVE-2017-9844

SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...