PT-2024-31397 · Phpoffice · Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: PHPSpreadsheet versions prior to 2.1.0 Description: The issue concerns the PhpOfficePhpSpreadsheetWriterHtml component, which fails to sanitize spreadsheet styling information, such as font names. This allows an attacker to inject arbitrary...

CVE-2024-7848

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpkupvfupdatedoc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticat...

WordPress User Private Files plugin <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Private File Access vulnerability discovered by Peter Thaleikis in WordPress Plugin User Private Files versions = 2.1.0...

WordPress plugin WPForms User Registration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2024-14475 · WordPress · Wpforms User Registration

Name of the Vulnerable Software and Affected Versions: WPForms User Registration versions n/a through 2.1.0 Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in WPForms User Registration. Recommendations: For versions n/a through 2.1.0, update to a...

WordPress Donation Block for PayPal plugin <= 2.1.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Donation Block For PayPal versions = 2.1.0...

CVE-2024-5765 WpStickyBar <= 2.1.0 - Unauthenticated SQLi

The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

PT-2024-28161 · Google · Events Calendar

Name of the Vulnerable Software and Affected Versions: Events Calendar for Google versions through 2.1.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. Recommendations: For...

WordPress Events Calendar for Google plugin <= 2.1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Events Calendar for Google versions = 2.1.0...

CVE-2024-39897

CVE-2024-39897 affects Zot’s registry code (zot) prior to 2.1.0. The cache driver GetBlob() can read any blob without an access check, enabling an attacker who knows an image name and a blob digest (to which they have no read access) to read that blob via another repository that the attacker can ...

CVE-2024-39897 Cache driver GetBlob() allows read access to any blob without access control check

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...

PT-2024-28715 · Zot · Zot

Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.0 Description: The cache driver GetBlob in zot, an OCI image registry, allows read access to any blob without an access control check. If a Zot accessControl policy allows users read access to some repositories but...

Security Bulletin: IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation.

Summary IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details...

WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP Job Manager - Resume Manager versions = 2.1.0...

WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP Job Manager - Resume Manager versions = 2.1.0...

PT-2024-26863

Name of the Vulnerable Software and Affected Versions WP Hotel Booking plugin for WordPress versions up to, and including, 2.1.0 Description The issue allows for SQL Injection via the room type parameter of the "/wphb/v1/rooms/search-rooms" REST API endpoint due to insufficient escaping on the...

OPENSUSE-SU-2024:10886-1 kafka-source-2.1.0-3.6 on GA media

These are all security issues fixed in the kafka-source-2.1.0-3.6 package on the GA media of openSUSE Tumbleweed...

CVAT Security Vulnerabilities

CVAT is an interactive video and image annotation tool for computer vision. A security vulnerability exists in CVAT Computer Vision Annotation Tool version 2.1.0 through versions prior to 2.14.3. An attacker can exploit the vulnerability to obtain sensitive information...

WordPress plugin Tracking Code Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

Thelia authentication bypass vulnerability

An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1...