CVE-2024-3983

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-3983

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-3983 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF

The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin, in versions prior to 30.2 , is vulnerable to a lack of authorization and CSRF protection in various AJAX actions . This flaw allows any authenticated user, such as a subscriber , to create, update, or delete customer metadata. Because metadata v...

PT-2024-18272 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.2 Description: The issue concerns a lack of authorization and CSRF protection in various AJAX actions within the plugin, allowing any authenticated user to update, delete, or...

CVE-2024-3083

A “CWE-352: Cross-Site Request Forgery CSRF” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page...

CVE-2024-6412

The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-6412 HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF

The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-6695

The WordPress profile-builder plugin (versions

Cross-Site Scripting (XSS)

com.jfinal, jfinal is vulnerable to Cross-Site Scripting. The vulnerability is due to improper validation of user input in the argument directory of the file /admin/template. Attackers can exploit this vulnerability remotely by injecting malicious scripts, potentially leading to unauthorized...

The vulnerability of the Custom Actions component in the software support services of Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus allows a attacker to execute XSS attacks.

The vulnerability of the Custom Actions component in the software support services of Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus exists due to the lack of protective measures for the website structure. Exploiting this...

CVE-2023-38001

IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260206...

ROS-20240729-07

Vulnerability in the GLPI request and incident handling system related to improper privilege management. privileges. Exploitation of the vulnerability could allow an attacker acting remotely to steal confidential information Vulnerability in the GLPI reporting plugin is related to improper...

CVE-2024-4410

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. This makes it possible for...

CVE-2024-4410 IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. This makes it possible for...

CVE-2024-4410

CVE-2024-4410 — IgnitionDeck Crowdfunding Platform (WordPress) Affected: IgnitionDeck Crowdfunding Platform plugin for WordPress (

CVE-2024-4410 IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. This makes it possible for...

PT-2024-30951 · WordPress · Ignitiondeck Crowdfunding Platform

Name of the Vulnerable Software and Affected Versions: IgnitionDeck Crowdfunding Platform plugin for WordPress versions up to, and including, 1.9.8 Description: The issue is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. Th...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41110 Moby authz zero length regression

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The base likelihood of this being...