Wind River Support Network

HomeCVE Database

The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.

Reset
Showing
of 216078 entries
IDDescriptionPriorityModified date
CVE-2024-29131 Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue. -- Mar 21, 2024
CVE-2024-29130 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.0. -- Mar 19, 2024
CVE-2024-29129 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in WPLIT Pty Ltd OxyExtras allows Reflected XSS.This issue affects OxyExtras: from n/a through 1.4.4. -- Mar 19, 2024
CVE-2024-29128 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affects POST SMTP: from n/a through 2.8.6. -- Mar 19, 2024
CVE-2024-29127 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20. -- Mar 19, 2024
CVE-2024-29126 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Jose Mortellaro Specific Content For Mobile – Customize the mobile version without redirections allows Reflected XSS.This issue affects Specific Content For Mobile – Customize the mobile version without redirections: from n/a through 0.1.9.5. -- Mar 19, 2024
CVE-2024-29125 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates allows Reflected XSS.This issue affects Coupon Affiliates: from n/a through 5.12.7. -- Mar 19, 2024
CVE-2024-29124 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20. -- Mar 19, 2024
CVE-2024-29123 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6. -- Mar 19, 2024
CVE-2024-29122 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212. -- Mar 19, 2024
CVE-2024-29121 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Firassaidi WooCommerce License Manager allows Reflected XSS.This issue affects WooCommerce License Manager: from n/a through 5.3.1. -- Mar 19, 2024
CVE-2024-29118 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Scrollsequence allows Stored XSS.This issue affects Scrollsequence: from n/a through 1.5.4. -- Mar 19, 2024
CVE-2024-29117 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Stored XSS.This issue affects Contact Forms by Cimatti: from n/a through 1.7.0. -- Mar 19, 2024
CVE-2024-29116 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in IconicWP WooThumbs for WooCommerce by Iconic allows Reflected XSS.This issue affects WooThumbs for WooCommerce by Iconic: from n/a through 5.5.3. -- Mar 19, 2024
CVE-2024-29115 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Zaytech Smart Online Order for Clover allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through 1.5.5. -- Mar 19, 2024
CVE-2024-29114 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84. -- Mar 19, 2024
CVE-2024-29113 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.2.5.9. -- Mar 19, 2024
CVE-2024-29112 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in WP Marketing Robot WooCommerce Google Feed Manager allows Stored XSS.This issue affects WooCommerce Google Feed Manager: from n/a through 2.2.0. -- Mar 19, 2024
CVE-2024-29111 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Webvitaly Sitekit allows Stored XSS.This issue affects Sitekit: from n/a through 1.6. -- Mar 19, 2024
CVE-2024-29110 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Pauple Table & Contact Form 7 Database – Tablesome allows Reflected XSS.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.27. -- Mar 19, 2024
CVE-2024-29109 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Jan-Peter Lambeck & 3UU Shariff Wrapper allows Stored XSS.This issue affects Shariff Wrapper: from n/a through 4.6.10. -- Mar 19, 2024
CVE-2024-29108 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Leevio Happy Addons for Elementor allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.10.1. -- Mar 19, 2024
CVE-2024-29107 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10. -- Mar 19, 2024
CVE-2024-29106 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.16. -- Mar 19, 2024
CVE-2024-29105 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Timersys WP Popups allows Stored XSS.This issue affects WP Popups: from n/a through 2.1.5.5. -- Mar 19, 2024
CVE-2024-29104 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Zimma Ltd. Ticket Tailor allows Stored XSS.This issue affects Ticket Tailor: from n/a through 1.10. -- Mar 19, 2024
CVE-2024-29103 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.This issue affects Database for Contact Form 7: from n/a through 3.0.6. -- Mar 19, 2024
CVE-2024-29102 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6. -- Mar 19, 2024
CVE-2024-29101 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.2. -- Mar 19, 2024
CVE-2024-29099 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Evergreen Content Poster allows Reflected XSS.This issue affects Evergreen Content Poster: from n/a through 1.4.1. -- Mar 19, 2024
CVE-2024-29098 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Calameo WP Calameo allows Stored XSS.This issue affects WP Calameo: from n/a through 2.1.7. -- Mar 19, 2024
CVE-2024-29097 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20. -- Mar 19, 2024
CVE-2024-29096 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Matt Manning MJM Clinic.This issue affects MJM Clinic: from n/a through 1.1.22. -- Mar 19, 2024
CVE-2024-29095 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Paul Ryley Site Reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 6.11.6. -- Mar 19, 2024
CVE-2024-29094 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7. -- Mar 19, 2024
CVE-2024-29093 Cross-Site Request Forgery (CSRF) vulnerability in Tobias Conrad Builder for WooCommerce reviews shortcodes – ReviewShort.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through 1.01.3. -- Mar 19, 2024
CVE-2024-29092 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3. -- Mar 19, 2024
CVE-2024-29091 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Dnesscarkey WP Armour – Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour – Honeypot Anti Spam: from n/a through 2.1.13. -- Mar 19, 2024
CVE-2024-29089 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14. -- Mar 19, 2024
CVE-2024-29071 HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings. -- Mar 25, 2024
CVE-2024-29059 .NET Framework Information Disclosure Vulnerability -- Mar 25, 2024
CVE-2024-29057 Microsoft Edge (Chromium-based) Spoofing Vulnerability -- Mar 26, 2024
CVE-2024-29042 Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue. -- Mar 22, 2024
CVE-2024-29041 Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3. -- Mar 26, 2024
CVE-2024-29037 datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens. -- Mar 21, 2024
CVE-2024-29036 Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`. -- Mar 21, 2024
CVE-2024-29034 CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn\'t fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what\'s allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6. -- Mar 25, 2024
CVE-2024-29033 OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one\'s own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`. -- Mar 21, 2024
CVE-2024-29032 Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue. -- Mar 21, 2024
CVE-2024-29031 Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue. -- Mar 21, 2024
The 'Fixed Release' column is displayed if a single product version is selected from the filter. The fixed release is applicable in cases when the CVE has been addressed and fixed for that product version. Requires LTSS - customers must have active LTSS (Long Term Security Shield) Support to receive up-to-date information about vulnerabilities that may affect legacy software. Please contact your Wind River account team or see https://docs.windriver.com/bundle/Support_and_Maintenance_Supplemental_Terms_and_Conditions and https://support2.windriver.com/index.php?page=plc for more information.
Live chat
Online