Ngô Thiên An

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: EventON، الإصدارات غير متوفرة حتى 2.3.2 الوصف: تتعلق المشكلة بـ «التحكم غير السليم في اسم الملف» في تعليمات include/require في برنامج PHP، والمعروفة أيضًا باسم «تضمين ملفات PHP عن بُعد» (PHP Remote File Inclusion). وهي نوع من الثغرات الأمنية التي يمكن للمهاجم من خلالها التلاعب باسم الملف المستخدم في تعليمات include أو require، مما قد يتيح له تنفيذ تعليمات برمجية ضارة. التوصيات: بالنسبة للإصدارات من n/a حتى 2.3.2، قم بالتحديث إلى إصدار أحدث من 2.3.2 لحل المشكلة. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

Name of the Vulnerable Software and Affected Versions: AREOI All Bootstrap Blocks versions 1.3.19 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File Inclusion. Recommendations: For versions 1.3.19 and earlier, update to a version that fixes this issue, as the current version allows for PHP Local File Inclusion due to improper control of filenames in include/require statements. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored XSS. This means that an attacker can inject malicious code into the web page, potentially affecting users who access the page.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion. This could potentially lead to system compromise.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. A Cross Site Scripting (XSS) vulnerability exists in the WP Delicious Delicious Recipes – WordPress Recipe Plugin.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored Cross-site Scripting (XSS). This is a type of security vulnerability that occurs when an application includes user input in its output without proper validation or sanitization, enabling an attacker to inject malicious scripts into the website.

The issue is related to Stored Cross-Site Scripting via the `carousel direction` parameter of the testimonials widget. This is due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS. This means that an attacker can inject malicious code into the website, which will be stored and executed when other users access the site.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS. This means that an attacker can inject malicious code into a website, potentially affecting users who visit the site.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping on user-supplied attributes like `title tag`. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via block ids due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

Name of the Vulnerable Software and Affected Versions: SiteOrigin Widgets Bundle plugin for WordPress versions up to, and including, 1.62.2 Description: The issue is related to Stored Cross-Site Scripting via the Image Grid widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 1.62.2, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the Image Grid widget for users with contributor-level access and above until a patch is available.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, which can be exploited.

The issue is related to Stored Cross-Site Scripting via the plugin's Sharing block due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.