The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebookpixelid and googleanalyticsid settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.

Secunia Research reported a flaw in KDE KGet that can be used by a malicious attacker to potentially compromise a user's system. The "name" attribute of the "file" element in metalink files is not properly sanitized before being used to download files. If a user were tricked into downloading a specially crafted metalink file, it could be used to download files to directories outside of the intended download directory via directory traversal flaws. KGet will start to download files in the background even before a user confirms whether or not they want the particular file downloaded, which could lead to KGet silently overwriting existing files with the same name.

This flaw has been assigned the name CVE-2010-1000. It also only affects KGet in KDE 4.x and does not affect earlier versions. Only Red Hat Enterprise Linux 6 and Fedora would be affected.

filters/any-UTF8 in konwert 1.8 allows local users to delete arbitrary files via a symlink attack on a /tmp/any-##### temporary file.

Buffer overflow in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.