CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security WordPress plugin (versions 9.0.0 to 9.1.1.1) is vulnerable to an authentication bypass due to improper user check error handling in the check_login_and_get_user function during two-factor REST API actions. When Two-Factor Authentication is enabled, unauthenticated attac...

PT-2024-16350

Name of the Vulnerable Software and Affected Versions WP Chat App plugin for WordPress versions up to, and including, 3.6.8 Description The issue arises from a missing capability check on the ajax install plugin function, allowing authenticated attackers with Subscriber-level access and above to...

MAL-2024-10762 Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

containernetworking-plugins security update

1:1.5.1-2 - rebuild for CVE-2024-24791 - Resolves: RHEL-47166 1:1.5.1-1 - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1 - Related: RHEL-27608 1:1.5.0-1 - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0 - Related: RHEL-27608 1:1.4.1-1 -...

VulnCheck KEV: CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.12-beta-2), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.12-beta-2) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.12-beta-2)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.12-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.12-beta-2 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.10) +2 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.10)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.10 -...

Wrap Up the Year with the Biggest Scope and Rewards Yet: Join the Wordfence Bug Bounty Program End of Year Holiday Extravaganza!

The holidays are here, and so is your chance to earn big while helping secure the WordPress ecosystem! For all submissions to our Bug Bounty Program from November 12, 2024, to December 9, 2024 , we’re rolling out our End of Year Holiday Extravaganza promotion to give back to our security...

Jenkins plugins Multiple Vulnerabilities (2024-11-13)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform...

RHSA-2024:9056 Red Hat Security Advisory: gstreamer1-plugins-base security update

Bulletin has no description...

AlmaLinux 8 : gstreamer1-plugins-base (ALSA-2024:9056)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:9056 advisory. gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory...

SUSE SLED15: apache-commons-lang3 / apache-commons-lang3-javadoc / bcel / etc (SUSE-SU-SUSE-RU-2024:3971-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2024:3971-1 advisory. xalan-j2 was updated from version 2.7.2 to 2.7.3: - Security issues fixed: CVE-2022-34169: Fixed...

Oracle Linux 8 : gstreamer1-plugins-base (ELSA-2024-9056)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9056 advisory. - CVE-2024-4453 gstreamer1: EXIF Metadata Parsing Integer Overflow Tenable has extracted the preceding description block directly from the Oracle Linux security...

CVE-2024-34014

Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM Linux before build 1.9.1.892, Acronis Backup extension for Plesk Linux...

Arbitrary file overwrite during recovery due to improper symbolic link handling

Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin improperly handled symbolic links during recovery. This allowed plugin users with unprivileged local access to the server to overwrite arbitrary files on the server. They could achieve this by creating a symbolic link in their home...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2024-52354

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes-for-amp-web-stories-and-elementor-widget allows Stored XSS.This issue affects Web Stories Widgets For Elementor: from n/a through = 1.1...