WordPress Smart Slider 3 Plugin <= 3.5.1.22 is vulnerable to Broken Access Control

Software Smart Slider 3 Type Plugin Vulnerable versions = 3.5.1.22 Fixed in 3.5.1.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3027 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c46698c777af Credits Christiaan Swiers YouGina...

CVE-2024-3027

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to uploa...

CVE-2024-3027 Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to uploa...

Smart Slider 3 < 3.5.1.23 - Contributor+ Stored XSS via SVG Upload

Description The plugin does not properly validate that users calling its upload function are allowed to making it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks...

PT-2024-23311 · WordPress · Smart Slider 3

Name of the Vulnerable Software and Affected Versions: Smart Slider 3 plugin for WordPress versions up to, and including, 3.5.1.22 Description: The issue arises from a missing capability check on the upload function, allowing authenticated attackers with contributor-level access and above to uplo...

SUSE SLES15 Security Update : kernel RT (Live Patch 3 for SLE 15 SP5) (SUSE-SU-2024:1183-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1183-1 advisory. This update for the Linux Kernel 5.14.21-1505001311 fixes several issues. The following security issues were fixed: - CVE-2024-0565: Fixed an...

CVE-2024-30708

CVE-2024-30708 is rejected/not used; the CNA withdrew it and there is no evidence of a vulnerability.

CVE-2024-30721

CVE-2024-30721 is rejected; this candidate withdrawn and not an active vulnerability entry.

CVE-2024-30737

CVE-2024-30737 entry is rejected/not used; it does not represent an active vulnerability.

CVE-2024-29439

CVE-2024-29439 is rejected/not used per initial description.

ROS-20240410-02

Vulnerability in the HTTP/3 QUIC module of NGINX Plus, NGINX OSS web servers that allows an attacker to cause a denial of service. denial of service Vulnerability of ngxhttpv3module module of NGINX and NGINX Plus servers is related to memory usage after its release. memory after it has been freed...

CVE-2024-29445

This CVE entry is rejected and not used; it does not represent an active vulnerability entry.

CVE-2024-30718

CVE-2024-30718 entry is rejected/not used and does not represent an active vulnerability.

SUSE-SU-2024:1179-1 Security update for gnutls

This update for gnutls fixes the following issues: Security issues fixed: - CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange bsc1208143. - CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange bsc1217277. - CVE-2024-0567: Fixed an incorrect rejection of...

CVE-2024-30191

CVE-2024-30191 (and related entries CVE-2022-47522 lineage) affects Siemens SCALANCE W700/W721/W722/W734/W738/W748/W761/W774/W778/W786/WAM/WUM/WUM766 family and similar models, describing an override of a victim’s security context in 802.11 frames. The root cause: an attacker physically nearby ca...

CVE-2024-30688

CVE-2024-30688 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-30701

This CVE-2024-30701 entry is rejected and does not represent an active vulnerability.

CVE-2024-30676

The connected PT-2024-23559 entry identifies a Denial-of-Service flaw in ROS2 Iron Irwini, where ROS2 nodes can be remotely crashed (DoS) by a malicious user, disrupting system operation. Affected setup specifies ROS VERSION 2 with ROS PYTHON VERSION 3. Until a patch is available, the recommendat...

AZL-59255 CVE-2024-26811 affecting package kernel for versions less than 5.15.176.3-3

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid...

3-moutiers.fr Cross Site Scripting vulnerability OBB-3907805

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...