Son Tran

The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the `placement slug` parameter. This allows authenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The issue is related to Stored Cross-Site Scripting via the `exad infobox animating mask style` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags due to insufficient input sanitization and output escaping on user supplied attributes, such as `HTML tags`. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with author access or higher to inject arbitrary web scripts via the `image alt` parameter. This enables the execution of injected scripts whenever a user accesses an affected page.

The issue is related to Stored Cross-Site Scripting via the `alignment` parameter in the Woo Product Carousel widget. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's Calendy widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the child page index widget due to insufficient input sanitization and output escaping on user-supplied attributes such as `className`. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the EmbedPress document widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's widget/block due to insufficient input sanitization and output escaping on user-supplied attributes such as `className`. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to insufficient validation of incoming requests, allowing an authenticated user with Connection edit privileges to access connection information and exploit the test connection feature. This can lead to a denial of service (DoS) condition on the server by sending many requests. Malicious actors can also establish harmful connections with the server.

The issue is related to a session fixation vulnerability in the Airflow web interface, allowing an authenticated user to continue accessing the webserver even after their password has been reset by an admin. This vulnerability can be exploited by a remote attacker to hijack a user's session. When using the database session backend, existing sessions of the user are invalidated when the password is reset. However, when using the securecookie session backend, sessions are not invalidated and require changing the secure key and restarting the webserver. Users resetting their passwords are informed about this with a flash message warning in the UI.

The issue is related to improper input validation, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

A problematic issue affects the function `0x82730088` in the library `VIRAGTLT.sys` of the component IoControlCode Handler, leading to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

The issue is related to the generation of error messages containing sensitive information in the Apache Airflow AWS Provider.

The issue is related to the improper neutralization of special elements used in a command, which can lead to command injection. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.