PT-2024-23481 · Unknown · Sticky Anything

Name of the Vulnerable Software and Affected Versions: Sticky Anything versions n/a through 2.1.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to be injected into...

WordPress Sticky Anything Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software Sticky Anything Type Plugin Vulnerable versions = 2.1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30551 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 25bb0e7db645 Credits Mika Required privilege...

Elink Smart eSmartCam Security Vulnerability

Elink Smart eSmartCam is a smart camera from Elink Smart. A security vulnerability exists in Elink Smart eSmartCam version 2.1.5, which stems from a vulnerability that allows an attacker to extract hard-coded AES encryption keys from a binary file...

Directory traversal

Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind Cloudflare including crafatar.com are not affected. Instances using the Docker container as shown in the READ...

PT-2024-20534 · Crafatar · Crafatar

Name of the Vulnerable Software and Affected Versions: Crafatar versions prior to 2.1.5 Description: Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind...

AI Engine < 2.1.5 - Editor+ Arbitrary File Upload via add_image_from_url

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'addimagefromurl' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the...

DeShang DSShop Security Vulnerability

DeShang DSShop is a single-store mobile mall online store system from DeShang. A security vulnerability exists in DeShang DSShop before version 2.1.5, which originates from a path traversal caused by the operation of the parameter memberinfo in the file application/home/controller/MemberAuth.php...

PT-2024-11588 · Woocommerce · Wholesale Suite

Name of the Vulnerable Software and Affected Versions: Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More versions through 2.1.5 Description: The issue is related to a Missing Authorization vulnerability. This vulnerability...

CVE-2023-50840

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5...

PT-2023-31672 · WordPress · Wpdevelop Oplugins Booking Manager

Name of the Vulnerable Software and Affected Versions: wpdevelop oplugins Booking Manager versions 2.1.5 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitatio...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. An attacker with access to the private key of a correctly issued certificate and the ability...

GHSA-HWCC-4CV8-CF3H Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Issue Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between...

Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Issue Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between...

CVE-2023-51662 Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not...

PT-2023-8999 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: Snowflake Connector .NET versions 2.0.25 through 2.1.4 Description: The issue is related to errors in the certificate authentication procedure, which may allow a remote attacker to perform a Man-in-the-Middle MitM attack. The vulnerability is...

CVE-2023-41733

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in YYDevelopment Back To The Top Button plugin = 2.1.5 versions...

PT-2023-29459 · WordPress · Import Xml/Rss Feeds

Name of the Vulnerable Software and Affected Versions: Import XML and RSS Feeds WordPress plugin versions prior to 2.1.5 Description: The issue allows unauthenticated attackers to perform remote code execution RCE due to a web shell in the plugin. This web shell was introduced as a result of a...

WordPress WP Crowdfunding Plugin <= 2.1.5 is vulnerable to Broken Access Control

Software WP Crowdfunding Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41870 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 359139f3a075 Credits Elliot Required privilege...

Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG

The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC 1. Upload a malicious SVG: 2. Add to post and view SVG to see XSS...

Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG

The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. 1. Upload a malicious SVG: alert"XSS Test"; 2. Add to post and view SVG to see XSS...