USN-5181-1 jqueryui vulnerability

It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. CVE-2021-41184 It was discovered that jQuery U...

Malicious code in netlify-gocommerce-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf359de5ba0905071d75d7d2766b0c08ebe09383374772ba12baa19cecd3c5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4806 Malicious code in netlify-gocommerce-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf359de5ba0905071d75d7d2766b0c08ebe09383374772ba12baa19cecd3c5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2775

The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2775

The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2775 Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting

The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2775

The CVE-2022-2775 entry concerns the Fast Flow WordPress plugin, affected versions prior to 1.2.13. The root cause is inadequate sanitization/escaping of widget settings, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, inc...

Appsmith 跨站脚本漏洞

Appsmith is an open source platform from Appsmith Open Source for building, deploying and maintaining internal applications. A security vulnerability exists in Appsmith version 1.7.14, which originates from server-side JavaScript injection and allows remote attackers to execute arbitrary JavaScri...

WordPress plugin Fast Flow 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-25017 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions through 1.7.14 Description: The issue allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget. This can be used to perform Denial of Service DoS attacks or...

WordPress plugin Trending/Popular Post Slider and Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

widget.fohweb.com Cross Site Scripting vulnerability OBB-2824634

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in mep-widget-localizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f310734c8e72d28f8d9892e831726d172b517373a6c79419ca315bb718bf7013 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4555 Malicious code in mep-widget-localizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f310734c8e72d28f8d9892e831726d172b517373a6c79419ca315bb718bf7013 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a dashboard with an HTML widget...

JQuery UI < 1.13.2 XSS

The version of JQuery UI library hosted on the remote web server is prior to 1.13.2. It is, therefore, affected by a cross-site scripting vulnerability in the JQuery UI that allows remote attackers to inject arbitrary web script or HTML via processing the value of a compromised checkboxradio...

Tagify - Moderately critical - Access bypass - SA-CONTRIB-2022-051

This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance. The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit...

Malicious code in widget-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11fb4eb17cdfa32c56a212c17456930bb8bc11fe911723de40f99c71dfe42c49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7145 Malicious code in widget-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11fb4eb17cdfa32c56a212c17456930bb8bc11fe911723de40f99c71dfe42c49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...