Smart Recent Posts Widget <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Smart Recent Posts Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WP Page Post Widget Clone <= 1.0.1 - Missing Authorization

Description The WP Page Post Widget Clone plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with contributor-level access and above, to perform...

Meks Smart Social Widget <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0. An attacker could exploit the vulnerability to enumerate a list of valid usernames by publicly exposing the URL using a shared widget...

CVE-2024-25938

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An...

CVE-2024-25938

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An...

CVE-2024-25938

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An...

CVE-2024-25938

CVE-2024-25938 affects Foxit Reader 2024.1.0.23997 and is a use-after-free vulnerability in the Barcode widget. According to Talos, a specially crafted JavaScript in a malicious PDF can trigger reuse of a freed object, leading to memory corruption and potentially arbitrary code execution. Exploit...

CVE-2024-25648

A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. A...

Malicious code in vue2-amis-custom-widget-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7995bc4ce2d3fd487e75baadf8d21d894607e1f79d0142c3aed2ed6c5bf88136 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vue2-amis-custom-widget-kk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de21054a3b5e13b8447bf6f0be9f2fe496ccdc7a29fd73162292d1373ed8437f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1311 Malicious code in vue2-amis-custom-widget-kk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de21054a3b5e13b8447bf6f0be9f2fe496ccdc7a29fd73162292d1373ed8437f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1310 Malicious code in vue2-amis-custom-widget-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7995bc4ce2d3fd487e75baadf8d21d894607e1f79d0142c3aed2ed6c5bf88136 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Fancy Elementor Flipbox plugin <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Fancy Elementor Flipbox versions = 2.5.1...

WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Archives Calendar Widget versions = 1.0.15...

WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin TweetScroll Widget versions = 1.3.7...

WordPress Archives Calendar Widget Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Software Archives Calendar Widget Type Plugin Vulnerable versions = 1.0.15 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33950 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5d201ab70e97 Credits Joshua Chan Required privilege...

Foxit Reader Barcode widget Calculate event use-after-free vulnerability

Talos Vulnerability Report TALOS-2024-1958 Foxit Reader Barcode widget Calculate event use-after-free vulnerability April 30, 2024 CVE Number CVE-2024-25938 SUMMARY A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScrip...

WordPress TweetScroll Widget Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software TweetScroll Widget Type Plugin Vulnerable versions = 1.3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33948 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 3dc090758c1a Credits Joshua Chan Required privilege...

The vulnerability of the Testimonial Widget Attributes component in the Jeg Elementor Kit plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Testimonial Widget Attributes component in the Jeg Elementor Kit plugin of the WordPress content management system is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site...