CVE-2024-38971

CVE-2024-38971 affects vaeThink 1.0.2 and is a stored XSS vulnerability in the system backend. Multiple sources (Red Hat, NVD, OSV, CNNVD, CVE lists) confirm the issue; exploitation details are not provided in the documents. Some connected sources (PT-Security) advise temporarily disabling the ba...

vaeThink Security Vulnerabilities

vaeThink is a software application. Based on ThinkPHP5 and Layui development, while keeping the core concepts of rapid development and the road to simplicity unchanged, it provides basic development and encapsulation of the functions necessary for general projects, helping users to quickly comple...

CVE-2024-38970

The CVE-2024-38970 entries describe a vulnerability in vaeThink 1.0.2 where information disclosure can occur through the system backend, specifically via the access management administrator function. Available sources consistently identify the affected software (vaeThink 1.0.2) and the impact as ...

CVE-2024-38971

vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting XSS in the system backend...

CVE-2024-5535

Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or ...

WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Demo Awesome versions = 1.0.2...

WordPress plugin MIMO Woocommerce Order Tracking security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress MIMO Woocommerce Order Tracking plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin MIMO Woocommerce Order Tracking versions = 1.0.2...

PT-2024-34866 · WordPress · Expert Invoice Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Expert Invoice WordPress plugin versions 1.0.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example...

CVE-2024-35661

Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2...

WordPress plugin Upload Fields for WPForms Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Custom Dash security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Custom Dash plugin <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin Custom Dash versions = 1.0.2...

WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Upload Fields for WPForms versions = 1.0.2...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Uncontrolled Resource Consumption (CVE-2024-2511)

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service. This problem can occur in...

WordPress Expert Invoice plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Guido Iván García Duva in WordPress Plugin Expert Invoice versions = 1.0.2...

CVE-2024-4741

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin Easy Digital Downloads – Recent Purchases versions = 1.0.2...

Amazon Linux 2 : edk2 (ALAS-2024-2539)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2539 advisory. Issue summary: Some non-default TLS server configurations can cause unboundedmemory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to...

WordPress plugin WP etracker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...