CVE-2024-25096

CVE-2024-25096 concerns the WordPress Canto plugin. Affected: Canto

CVE-2024-27972

CVE-2024-27972 affects WP Fusion Lite (Very Good Plugins). An improper neutralization of special elements enables a command injection that leads to authenticated remote code execution in WP Fusion Lite versions up to 3.41.24. The vulnerability requires authentication (Contributor+ per enrichment)...

CVE-2024-30173

CVE-2024-30173 maps to an authentication bypass in the TYPO3 OpenID Connect Authentication extension. The TYPO3 extension’s authentication service does not verify the OpenID Connect authentication state from the user lookup chain and instead authenticates every valid frontend user whose tx_oidc f...

GHSA-GP8G-F42F-95Q2 ZITADEL's actions can overload reserved claims

Impact Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name json "urn:zitadel:iam:user:resourceowner:name": "ACME" if it was not set by ZITADEL itself. To compensate for this w...

ZITADEL's actions can overload reserved claims

Impact Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name json "urn:zitadel:iam:user:resourceowner:name": "ACME" if it was not set by ZITADEL itself. To compensate for this w...

CVE-2024-29892

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

CVE-2024-29892 ZITADEL's actions can overload reserved claims

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

CVE-2024-29892 ZITADEL's actions can overload reserved claims

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...

CVE-2024-24850

CVE-2024-24850: Quicksand Post Filter jQuery Plugin (WordPress) <= 3.1.1 has a Missing Authorization vulnerability via quicksand_admin_ajax, allowing unauthenticated access to delete arbitrary site options (Broken Access Control). The CVE is listed with a high risk in WordPress vulnerability f...

CVE-2024-27967

CVE-2024-27967 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the plugin “DSGVO All in one for WP” by Michael Leithold. The vulnerability affects versions from n/a up to 4.3. The NVD metrics indicate a high-severity impact (CVSS v3.1: 8.8, HIGH) with network attack vector, no priv...

CVE-2024-27970

CVE-2024-27970 affects the WP SendFox WordPress plugin (WP SendFox) up to version 1.3.0. It is a Missing Authorization vulnerability allowing unauthorized actions. CVSSv3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; base score 5.4. Patch status: Patched (update to a newer version).

CVE-2024-27985

CVE-2024-27985 : Deserialization of untrusted data in PropertyHive (WordPress) allows PHP Object Injection in versions up to 2.0.9 (authenticated as Subscriber+). Impact details per CVSS: 8.8 (HIGH) with network attack vector, no user interaction required; affects confidentiality, integrity, and ...

CVE-2024-27990

CVE-2024-27990 is a Stored Cross-Site Scripting vulnerability in WordPress plugin The Moneytizer, affecting versions up to 9.5.20. The issue arises from improper input neutralization during web-page generation, enabling authenticated (Contributor+) users to inject scripts that can be stored and l...

CVE-2024-27992

CVE-2024-27992 is a Reflected XSS in the WordPress plugin Link Whisper Free . Public disclosures indicate the vulnerability affects versions from some unspecified start up to and including 0.6.8, with the issue present in the Free edition and not in Pro as described in sources. Multiple CVE recor...

CVE-2024-28746

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-28251

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-28323

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-28417

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-28418

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-28383

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...