CVE-2024-51657

CVE-2024-51657 affects WordPress SmartLink Dynamic URLs plugin (versions up to 1.1.0). Root cause: CSRF that can lead to Stored XSS. Impact per CVSS: HIGH (7.1). Exploitation requires unauthenticated access; user interaction is not necessarily needed for CSRF, but the stored XSS effect can occur ...

CVE-2024-51657 WordPress SmartLink Dynamic URLs plugin <= 1.1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

CVE-2024-51657 WordPress SmartLink Dynamic URLs plugin <= 1.1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw. The software includes ConfigProvider plugins, specifically FileConfigProvider , DirectoryConfigProvider , and EnvVarConfigProvider , which allow reading from the disk or ...

RockyLinux 8 : gstreamer1-plugins-base (RLSA-2024:9056)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:9056 advisory. gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 Tenable has extracted the preceding description block directly from the RockyLinux security...

Oracle Linux 9 : containernetworking-plugins (ELSA-2024-9089)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9089 advisory. - rebuild for CVE-2024-24791 - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723...

CVE-2024-51657: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

PT-2024-34801

Name of the Vulnerable Software and Affected Versions Woopy Plugins SmartLink Dynamic URLs versions 1.1.0 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Woopy Plugins SmartLink Dynamic URLs. Recommendations For versions 1.1.0 and...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-52304 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-52304 Source...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

wordpress-really-simple-security-authn-bypass-vulnerable-appli...

Really Simple Security Free Privilege Escalation

The vulnerabilities of the Really Simple Security Free, Really Simple Security Pro, and Really Simple Security Pro Multisite plugins of the WordPress content management system are related to authentication process flaws. Exploiting these vulnerabilities can allow attackers to increase their...

org.apache.camel.springboot:camel-debezium-sqlserver-starter (>=3.15.0, <=3.16.0), org.apache.camel:camel-debezium-sqlserver (>=3.15.0, <=3.16.0) +3 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.8.0.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - org.apache.camel.springboot:camel-debezium-sqlserver-starter =3.15.0,...

com.hazelcast.jet:hazelcast-jet-cdc-mysql (>=5.3.0-beta-1, <=5.3.8), com.hazelcast:hazelcast-distribution (5.3.0-beta-1) +10 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (1.9.7.final)

io.debezium:debezium-connector-mysql MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - com.hazelcast.jet:hazelcast-jet-cdc-mysql =5.3.0-beta-1, =2.4.0, =0.1.0,...

io.cdap.delta:database-delta-plugins (>=0.1.1, <=0.1.3), io.debezium:debezium-connector-mongodb (0.9.5.final) +10 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (0.9.5.final)

io.debezium:debezium-core MAVEN version 0.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.cdap.delta:database-delta-plugins =0.1.1, =3.0.0-rc2, =3.0.0-rc2, =3.0.0-rc3 Source cves:...

com.ververica:flink-connector-sqlserver-cdc (>=2.4.0, <=3.0.1), io.cdap.delta:sqlserver-delta-plugins (0.10.0) +2 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.9.7.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - com.ververica:flink-connector-sqlserver-cdc =2.4.0, =0.1.0,...

Exploit for Missing Authorization in Wpxpo Postx

CVE-2024-10728 PostX = 4.1.16 - Missing Authorization to A...

RHSA-2024:9089 Red Hat Security Advisory: containernetworking-plugins security update

Bulletin has no description...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2024-45784 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2024-45784 Source advisory: OSV:PYSEC-2024-182...

CVE-2024-9529

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privile...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...