14667 matches found
CVE-2024-49340 IBM Watson Studio Local cross-site request forgery
IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2024-49340
IBM Watson Studio Local 1.2.3 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. The issue allows an attacker to trigger actions on behalf of a trusted user, leading to potential unauthorized changes. The publicly documented remediation points to upgrading/remediating to a fixed ve...
PT-2024-10746 · WordPress · Ari Adminer
Name of the Vulnerable Software and Affected Versions: ARI-Adminer plugin for WordPress versions up to, and including, 1.1.14 Description: The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin. This make...
VulnCheck KEV: CVE-2019-25214
The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating...
VulnCheck KEV: CVE-2020-36837
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
PT-2024-10843 · WordPress · Indeed Membership Pro
Name of the Vulnerable Software and Affected Versions: Indeed Membership Pro plugin for WordPress versions 7.3 through 8.6 Description: The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions. This makes it...
PT-2024-10849 · WordPress · Wp Lead Plus X
Name of the Vulnerable Software and Affected Versions: WP Lead Plus X plugin for WordPress versions up to, and including, 0.99 Description: The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This...
PT-2024-11043 · WordPress · Essential Addons For Elementor
Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to and including 4.6.4 Description: The issue is related to authorization bypass due to missing capability checks and nonce disclosure. This allows authenticated attackers wi...
VulnCheck KEV: CVE-2020-36834
The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions a...
VulnCheck KEV: CVE-2020-36842
The Migration, Backup, Staging -WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...
IBM Watson Studio Local 跨站请求伪造漏洞
IBM Watson Studio Local is a suite of collaborative data processing solutions from International Business Machines IBM. The product includes features such as data analysis, data visualization, data cleansing and streaming data extraction. A cross-site request forgery vulnerability exists in IBM...
PT-2024-11045
Name of the Vulnerable Software and Affected Versions Kaswara Modern VC Addons plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to insufficient capability checking on various AJAX actions, allowing unauthenticated attackers to perform unauthorized actions...
Amazon Linux 2023 : bubblewrap (ALAS2023-2024-726)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-726 advisory. A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can...
CVE-2024-8760
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration...
CVE-2024-8760 Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration...
CVE-2024-8760
CVE-2024-8760 covers Stackable – Page Builder Gutenberg Blocks (WordPress) with unauthenticated CSS Injection in versions
Optimizing and Maintaining SQL Server Instance Hosting Veeam Service Provider Console Configuration Database
Purpose This article was produced in coordination with the Veeam R&D team to provide Service Providers with a comprehensive list of the most common performance improvements and maintenance actions relating to the underlying Microsoft SQL Server instance that hosts the Veeam Service Provider Conso...
CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...
GHSA-GVV6-33J7-884G Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users download or view...