65 matches found
WordPress Automatic Plugin - Unauthenticated Options Change
WordPress Automatic Plugin versions 3.53.2 and below contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the processform.php script. The vulnerable script uses updateoption on all POST parameters without authentication or capability...
PT-2026-101461
ghsa-4374-p667-p6c8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
MINI-XG6P-Q5VP-4374
Bulletin has no description...
CVE-2026-4374
creationtimestamp| type| source ---|---|--- 2026-04-01 03:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifpglohut27 2026-04-01 03:18:36+00:00| seen| Telegram/jyatwHTsuiD0gHBEYEMrZjBra-amFrxPGWmF0zTmxDIL8I...
CVE-2026-4374
CVE-2026-4374 affects RTI Connext Professional (Routing Service, Observability Collector, Recording Service, Queueing Service, Cloud Discovery Service). The issue is an improper restriction of XML External Entity references, enabling Serialized Data External Linking and data serialization-related...
EUVD-2026-4374
Cross-Site Request Forgery CSRF vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through = 2.8.147...
CVE-2018-4374
A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...
CVE-2023-4374
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refreshlogsasync' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber...
[SECURITY] [DLA 4374-2] pdfminer security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4374-2 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 08, 2026 https://wiki.debian.org/LTS -...
DLA-4374-2 pdfminer - regression update
Bulletin has no description...
RHSA-2024:4374
creationtimestamp| type| source ---|---|--- 2025-05-21 01:45:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17098...
CVE-2025-4374
creationtimestamp| type| source ---|---|--- 2025-05-06 18:39:45+00:00| seen| https://t.me/cvedetector/24611 2025-05-06 20:21:18+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15214...
CVE-2025-4374 Quay: incorrect privilege assignment
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository...
CVE-2025-4374
CVE-2025-4374 affects Quay: when an organization acts as a proxy cache and a user/robot pulls an unmapped image, the newly created repository may be granted Admin privileges due to an improper privilege assignment in the proxy cache flow. Impact described as elevated (Admin) access on the new rep...
CVE-2025-4374 Quay: incorrect privilege assignment
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository...
CVE-2021-4374
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the processform.php file. This makes it possible for unauthenticated attackers to arbitrarily update the...
WordPress DethemeKit For Elementor Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)
Software DethemeKit For Elementor Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4374 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9962695def1c Credits stealthcopter...
CVE-2024-4374 DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-4374
CVE-2024-4374 affects the DethemeKit For Elementor WordPress plugin. A Stored XSS exists in widget attributes due to insufficient input sanitization and output escaping, enabling an authenticated attacker with contributor-level access or higher to inject scripts that run when users load injected ...