MAL-2025-1282 Malicious code in xt-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 888d6cec6842a849e2ec069a734943936ab4dcd497fb6dd9e81760860817728e Any computer that has this package install...

MAL-2025-1283 Malicious code in xt-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fed00145b4a626337b346006d12cb2cae629e16ec57d24bb94c191ccd5823c9 Any computer that has this package install...

MAL-2025-1284 Malicious code in xt-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4620b4c964cef23c75cd0562eabb2ff4b07f79eaf1dc268af62da2dcf99ee307 Any computer that has this package install...

PT-2024-36026 · Parasolid · Parasolid

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V36.1.225 Parasolid versions prior to V37.0.173 Parasolid versions prior to V37.1.1 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end o...

CVE-2024-9178

The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-9178

The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-9178 XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

PT-2024-39474 · WordPress · Xt Floating Cart For Woocommerce

Name of the Vulnerable Software and Affected Versions: XT Floating Cart for WooCommerce plugin for WordPress version 2.8.2 and earlier Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

WordPress plugin XT Floating Cart for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress XT Floating Cart for WooCommerce Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS)

Software XT Floating Cart for WooCommerce Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9178 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e5cbcbd17b66 Credits Frances...

kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable()

An out-of-bounds access vulnerability was found in the Linux Kernel. This issue occurs during the creation of a new netfilter table. The absence of safeguards in the nftablesnewtable function against invalid nftables family pf values allows attackers to achieve unauthorized access. Exploitation...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin (WordPress) is affected by CVE-2024-8716: Reflected Cross-Site Scripting due to improper escaping of add_query_arg in the URL for all versions up to 1.1.2. The vulnerability is exploitable by unauthenticated attackers who can entice a user to perform...

WordPress XT Ajax Add To Cart for WooCommerce Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software XT Ajax Add To Cart for WooCommerce Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8716 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID eca37d7857f2 Credit...

SUSE CVE-2024-35962

In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that doreplace handlers use copyfromsockptr which I fixed, followed by unsafe copyfromsockptroffset calls. In all functions, we can perform the @optlen...

PT-2024-8758 · Siemens · Parasolid +2

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V2312.0005 Teamcenter Visualization V14.2 versions prior to V14.2.0.12 Teamcenter Visualization V14.3 versions prior to V14.3.0.10 Teamcenter Visualization V2312 versions prior to V2312.0005 Parasolid affected versions...

PT-2024-3626 · Siemens · Parasolid

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V35.1.256 Parasolid versions prior to V36.0.210 Parasolid versions prior to V36.1.185 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end...

CVE-2023-34292

Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a maliciou...

CVE-2023-34292

Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a maliciou...

CVE-2024-26276

A vulnerability has been identified in JT2Go All versions V2312.0004, Parasolid V35.1 All versions V35.1.254, Parasolid V36.0 All versions V36.0.207, Parasolid V36.1 All versions V36.1.147, Teamcenter Visualization V14.2 All versions V14.2.0.12, Teamcenter Visualization V14.3 All versions...