WordPress MBE eShip Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software MBE eShip Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-38729 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4adf7a356e66 Credits Joshua Chan Required...

WordPress MBE eShip Plugin <= 2.1.2 is vulnerable to Sensitive Data Exposure

Software MBE eShip Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2.1 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-38742 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID df94a639a0f7 Credits Joshua Chan...

PT-2024-37488 · WordPress · Feeds For Youtube

Name of the Vulnerable Software and Affected Versions: The Feeds for YouTube plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode due to insufficient input sanitization and output...

WordPress plugin Feeds for YouTube security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-27603 · Crocoblock · Crocoblock Jetthemecore

Name of the Vulnerable Software and Affected Versions: Crocoblock JetThemeCore versions prior to 2.2.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows File Manipulation...

PT-2024-37195 · WordPress · Comment Images Reloaded

Name of the Vulnerable Software and Affected Versions: Comment Images Reloaded plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to a missing capability check on the cir delete image AJAX action. This allows authenticated attackers with Subscriber-level...

WordPress plugin JetThemeCore path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

MAL-2024-7426 Malicious code in textfx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f6802763dd48d6dac35423838aeb0d89a5e095be89203553f613264f4c314c16 The OpenSSF Package Analysis project identified 'textfx' @ 2.2.1 npm as malicious. It is considered malicious because: - The package communicate...

VulnCheck KEV: CVE-2024-37497

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Crocoblock JetThemeCore allows File Manipulation.This issue affects JetThemeCore: from n/a before 2.2.1...

Security Bulletin: IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation.

Summary IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details...

CVE-2023-51494

Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1...

PT-2024-14153 · Woocommerce · Woocommerce Product Vendors

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Vendors versions 2.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Woo WooCommerce Product Vendors. Recommendations: For versions 2.2.1 and earlier, update to a version later...

GHSA-CGWC-QVRX-RF7F Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

CVE-2024-5452 RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

CVE-2024-34806

CVE-2024-34806 describes a Cross-Site Request Forgery in the WordPress Clearfy Cache plugin up to version 2.2.1 (per CVE entry). The vulnerability arises from missing or incorrect nonce validation, enabling unauthenticated attackers to trigger actions via forged requests if a site admin is tricke...

PT-2024-25979 · Unknown · Counter Up

Name of the Vulnerable Software and Affected Versions: Counter Up versions through 2.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject maliciou...

WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Counter Up versions = 2.2.1...

PT-2024-25413 · Real Big Plugins · Real Big Plugins Client Dash

Name of the Vulnerable Software and Affected Versions: Real Big Plugins Client Dash versions 2.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Real Big Plugins Client Dash. Recommendations: For versions 2.2.1 and earlier, update to a version later tha...

WordPress plugin Client Dash 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL. WordPress plugin is ...

WordPress Client Dash plugin <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Skalucy Patchstack Alliance in WordPress Plugin Client Dash versions = 2.2.1...