PT-2024-26726

Name of the Vulnerable Software and Affected Versions Customizr versions 4.4.21 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-27400

Name of the Vulnerable Software and Affected Versions Rara Theme Book Landing Page versions 1.2.3 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-37396

Name of the Vulnerable Software and Affected Versions: Sparkle Demo Importer plugin for WordPress versions up to and including 1.4.7 Description: The issue arises from a missing capability check on multiple functions, allowing authenticated attackers with Subscriber-level access and above to...

PT-2024-26725

Name of the Vulnerable Software and Affected Versions Vimeography: Vimeo Video Gallery WordPress Plugin versions n/a through 2.4.1 Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2024-27396

Name of the Vulnerable Software and Affected Versions Tribulant Newsletters versions 4.9.7 and earlier Description The issue is a Cross Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application th...

CVE-2024-4382: Cross-Site Request Forgery (CSRF)

The CB legacy WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks...

PT-2024-27366

Name of the Vulnerable Software and Affected Versions blazethemes Digital Newspaper versions 1.1.5 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2024-26727

Name of the Vulnerable Software and Affected Versions Hueman versions 3.7.24 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is...

CVE-2024-38558

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVSPACKETCMDEXECUTE has 3 main attributes: - OVSPACKETATTRKEY - Packet metadata in a netlink format. - OVSPACKETATTRPACKET - Binary packet content. -...

CVE-2024-38558

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVSPACKETCMDEXECUTE has 3 main attributes: - OVSPACKETATTRKEY - Packet metadata in a netlink format. - OVSPACKETATTRPACKET - Binary packet content. -...

CVE-2024-38558

Technical details for CVE-2024-38558 are not publicly available in the provided documents. Monitor for updates from official advisories to confirm affected products, impact, and fixes.

Cross Site Request Forgery (CSRF)

moodle/moodle is vulnerable to Cross Site Request Forgery. The vulnerability is due to misuse of confirmsesskey. An attacker can exploit this flaw to perform unauthorized actions on behalf of a legitimate user...

PT-2024-12069

Name of the Vulnerable Software and Affected Versions GamiPress versions 2.5.6 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations For versions...

PT-2024-14000

Name of the Vulnerable Software and Affected Versions Averta Master Slider versions prior to 3.9.11 Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...

CVE-2024-2544 Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions,...

CVE-2024-2544 Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions,...

CVE-2024-2544

CVE-2024-2544 : The Popup Builder plugin for WordPress is affected by a missing capability check on all AJAX actions, enabling authenticated users with subscriber-level access and above to perform unauthorized actions (e.g., deleting or importing subscribers) and potentially facilitate stored XSS...

CVE-2024-2544: Missing Authorization

The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions,...

PT-2024-20944 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: Popup Builder plugin for WordPress affected versions not specified Description: The issue allows authenticated attackers with subscriber-level access and above to perform unauthorized actions due to a missing capability check on all AJAX...

CVE-2024-34539

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...