WordPress Hummingbird Plugin <= 3.7.3 is vulnerable to Broken Access Control

Software Hummingbird Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.7.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32792 Patch priority Low CVSS severity Low 4.3 Developer WPMU DEV PSID 9b701eb20e44 Credits Peng Zhou Required privilege...

WordPress Import any XML or CSV File to WordPress Plugin <= 3.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Import any XML or CSV File to WordPress Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.7.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31939 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a530bb25fc8a...

PT-2024-24303 · WordPress · Soflyy Import Any Xml/Csv File To Wordpress

Name of the Vulnerable Software and Affected Versions: Soflyy Import any XML or CSV File to WordPress versions 3.7.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Soflyy Import any XML or CSV File to WordPress. This issue allows an attacker to perform unintended actions...

WordPress Premmerce Product Filter for WooCommerce Plugin <= 3.7.2 is vulnerable to Broken Access Control

Software Premmerce Product Filter for WooCommerce Type Plugin Vulnerable versions = 3.7.2 Fixed in 3.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31359 Patch priority Low CVSS severity Low 4.3 Developer Premmerce PSID 053807f2d4c0 Credits Dhabaleshw...

WordPress plugin WP All Import security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-4808

The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Plugin WP Post Popup Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Cross site request forgery (csrf)

A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this...

CVE-2015-10125 WP Ultimate CSV Importer Plugin cross-site request forgery

A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this...

PT-2023-10302 · WordPress · Wp Ultimate Csv Importer Plugin

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer Plugin version 3.7.2 Description: A problematic vulnerability has been found in the WP Ultimate CSV Importer Plugin, affecting an unknown part, which leads to cross-site request forgery. The attack can be initiated...

CVE-2023-32182

A Improper Link Resolution Before File Access 'Link Following' vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before...

OpenRefine 路径遍历漏洞

OpenRefine is a Java-based open source tool. The product is mainly used for loading data, analyzing data and cleaning data. A path traversal vulnerability exists in OpenRefine version 3.7.3 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

WordPress EmbedPress Plugin <= 3.7.3 is vulnerable to Sensitive Data Exposure

Software EmbedPress Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.8.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-3371 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f1c35d9cb0cf Credits István Márton Required privileg...

CVE-2023-2023

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

WordPress plugin Custom 404 Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PrestaShop scquickaccounting 安全漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop scquickaccounting versions prior to v3.7.3 that stems from...

PT-2023-22622 · Unknown · Scquickaccounting

Name of the Vulnerable Software and Affected Versions: scquickaccounting versions prior to 3.7.3 Description: The issue is related to insecure permissions in the ps customer table, allowing unauthorized access to sensitive information such as name, surname, and email. This lack of permissions...

PT-2023-6577 · WordPress · Custom 404 Pro

Name of the Vulnerable Software and Affected Versions: Custom 404 Pro versions prior to 3.7.3 Description: The issue is related to the Custom 404 Pro WordPress plugin, which does not properly escape some URLs before outputting them in attributes. This can lead to Reflected Cross-Site Scripting,...

CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX...

vantage6-node (>=3.3.3 <=3.7.3), vantage6-server (>=3.3.3 <=3.7.3) potentially affected by CVE-2022-39228 via vantage6 (>=3.3.3 <=3.7.3)

vantage6 PYPI version =3.3.3, =3.3.3, =3.3.3, =3.7.3 Source cves: CVE-2022-39228 Source advisory: OSV:PYSEC-2023-313...