WordPress plugin Shariff Wrapper security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

CVE-2024-1106: Improper Neutralization of Input During Web Page Generation

The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-16732 · WordPress · Shariff Wrapper

Name of the Vulnerable Software and Affected Versions: Shariff Wrapper WordPress plugin versions prior to 4.6.10 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example,...

autotrain-advanced (>=0.6.14, <=0.6.15.dev0), llama2-wrapper (>=0.1.0, <=0.1.14) potentially affected by CVE-2024-1729 via gradio (3.37.0)

gradio PYPI version 3.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.14, =0.1.0, =0.1.14 Source cves: CVE-2024-1729 Source advisory: OSV:GHSA-HMX6-R76C-85G9...

PT-2024-15562 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate due to insufficient input sanitization a...

CVE-2024-0438: Improper Neutralization of Input During Web Page Generation

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

PT-2024-9841 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential buffer overflow in the map hw resources function. The function was accessing arrays using an index that could potentially be greater than the size o...

com.erudika:para-server (1.22.0), org.id4me:aim-api-wrapper (>=1.0, <=2.0) +7 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.33)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.33 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.erudika:para-server 1.22.0 - org.id4me:aim-api-wrapper =1.0, =1.0, =1.3.0-rc1, =1.3.0-rc1, =1.3.0-rc...

pl.coderion:openfoodfacts-java-wrapper (0.9.3) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.5.5)

io.micronaut:micronaut-http-server-netty MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - pl.coderion:openfoodfacts-java-wrapper 0.9.3 Source cves: CVE-2024-23639 Source...

autotrain-advanced (>=0.6.14, <=0.6.15.dev0), llama2-wrapper (>=0.1.0, <=0.1.14) potentially affected by CVE-2024-0964 via gradio (3.37.0)

gradio PYPI version 3.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autotrain-advanced =0.6.14, =0.1.0, =0.1.14 Source cves: CVE-2024-0964 Source advisory: OSV:GHSA-F3H9-8PHC-6GVH...

WordPress Shariff Wrapper Plugin < 4.6.10 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions 4.6.10 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1106 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID da44df395b73 Credits Dmitrii Ignatyev Require...

CVE-2024-0954

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient...

CVE-2024-0954: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient...

PT-2024-15934 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.7 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping on...

Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the...

Shariff Wrapper < 4.6.10 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the...

Exploit for PHP External Variable Modification in Juniper Junos

CVE-2023-36845 Description CVE-2023-36845 represen...

RHEL 8 : open-vm-tools (RHSA-2023:7264)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7264 advisory. The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualizati...

CloudLinux CageFS 7.1.1-1 Token Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CloudLinux CageFS Token Disclosure Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01CloudLinuxCageFSTokenDisclosure Vulnerability Overview CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a...

com.kurzdigital:keycloak-admin-wrapper (>=0.9.11, <=0.10.3), com.pleosoft:pleosoft-spring-boot-starter (1.0.5-release) +105 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (4.8.3.final)

org.keycloak:keycloak-core MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.kurzdigital:keycloak-admin-wrapper =0.9.11, =1.1.0, =1.2.2, =1.2.2, =7.1.0.m5, =7.1.0.m5,...