PT-2024-18125 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: gradio-app/gradio repository affected versions not specified Description: A command injection issue exists in the deploy+test-visual.yml workflow due to improper neutralization of special elements used in a command. This allows attackers to...

Rocky Linux 8 : .NET 8.0 (RLSA-2024:1311)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1311 advisory. - .NET and Visual Studio Denial of Service Vulnerability CVE-2024-21392 Note that Nessus has not tested for this issue but has instead relied only on the...

Rocky Linux 8 : .NET 7.0 (RLSA-2024:1308)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1308 advisory. - .NET and Visual Studio Denial of Service Vulnerability CVE-2024-21392 Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2024-2888

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26....

CVE-2024-2888 WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26....

CVE-2024-2888: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26....

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

PT-2024-40286

Name of the Vulnerable Software and Affected Versions: Burn versions affected versions not specified Description: The issue concerns an Elevation of Privilege Vulnerability where a low-privileged user can hijack binaries in an unprotected path, specifically the C:WindowsTemp directory, to elevate...

Code Reviewer

Reviews code Module Options msf use exploit/multi/fileformat/visual/studiovsixexec msf undefinedstudiovsixexec show actions ...actions... msf undefinedstudiovsixexec set ACTION msf undefinedstudiovsixexec show options ...show and set options... msf undefinedstudiovsixexec run This module requires...

Unspecified Vulnerability in Selesta Visual Access Manager (CNVD-2025-22662)

Selesta Visual Access Manager is a visual access manager from Selesta. A security vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to modify and receive ID-related computer POST parameters via POST HTTP request interception...

Visual Composer Website Builder < 45.7.0 - Authenticated (Editor+) Stored Cross-Site Scripting

Description The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 45.6.0 due to insufficient input sanitization and...

CVE-2023-50811

An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many...

CVE-2024-27997

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997 WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997 WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through = 45.6.0...

CVE-2024-27997

CVE-2024-27997 is a stored cross-site scripting vulnerability in Visual Composer Website Builder. The initial and connected documents indicate the flaw stems from improper input neutralization during web page generation, allowing stored XSS. Affected software is Visual Composer Website Builder, w...

Selesta Visual Access Manager security vulnerabilities

Selesta Visual Access Manager is a visual access manager from Selesta. A security vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to modify and receive ID-related computer POST parameters via POST HTTP request interception...

CVE-2023-50811

SELESTA Visual Access Manager 4.38.6 is affected by CVE-2023-50811. The vulnerability allows an attacker to modify the POST parameter named “computer” that encodes the ID of a specific reception via HTTP POST interception. By iterating this parameter, an attacker can gain access to the applicatio...

WordPress Plugin Visual Composer Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-50811

An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many...