Hitachi Energy RTU500 Series Product (Update B)

SUMMARY Hitachi Energy is aware of the vulnerability CVE-2024-2617 in the RTU500 Web server component, that affects the RTU500 versions that are listed below. An attacker successfully exploiting this vulnerability could bypass secure update. Please refer to the Recommended Immediate Actions for...

Arbitrary Systemd Property Injection

github.com/cri-o/cri-o is vulnerable to Arbitrary Systemd Property Injection. The vulnerability is due to improper filtering of systemd property within a Pod annotation, allowing an attacker with the ability to create a pod with arbitrary annotations to perform unauthorized actions on the host...

Seers | GDPR & CCPA Cookie Consent & Compliance < 8.1.1 - Cross-Site Request Forgery

Description The Seers | GDPR & CCPA Cookie Consent & Compliance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.1.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated...

PT-2024-4466 · Devika · Devika

Name of the Vulnerable Software and Affected Versions: Devika affected versions not specified Description: The issue is related to a cross-site request forgery CSRF attack. It may allow a remote attacker to exploit the vulnerability, potentially enabling them to perform unauthorized actions...

OESA-2024-1509 ignition security update

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote URL, network...

CVE-2024-3154 Cri-o: arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

CVE-2024-3154

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

PT-2024-25398

Name of the Vulnerable Software and Affected Versions Brijesh Kothari Smart Maintenance Mode versions 1.4.4 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-25447

Name of the Vulnerable Software and Affected Versions OptinMonster versions through 2.15.3 Description The issue is a Cross-Site Request Forgery CSRF vulnerability in OptinMonster Popup Builder. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

PT-2024-25438

Name of the Vulnerable Software and Affected Versions WP GDPR Compliance versions 2.0.23 and earlier Description A Cross-Site Request Forgery CSRF issue affects the WP GDPR Compliance plugin. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-25436

Name of the Vulnerable Software and Affected Versions MainWP Child Reports versions through 2.1.1 Description A Cross-Site Request Forgery CSRF issue affects MainWP Child Reports. This issue allows an attacker to perform unintended actions on the application. No information is provided about the...

PT-2024-25411

Name of the Vulnerable Software and Affected Versions Cryout Creations Serious Slider versions 1.2.4 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Easy CountDowner <= 1.0.8 - Cross-Site Request Forgery

Description The Easy CountDowner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions a...

SUSE CVE-2024-3154

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

Multiple vulnerabilities in RoamWiFi R10

Overview RoamWiFi R10 provided by RoamWiFi Technology Co., Ltd. contains multiple vulnerabilities listed below. Active debug code CWE-489 - CVE-2024-31406 Insertion of sensitive information into log file CWE-532 - CVE-2024-32051 Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities...

PT-2024-24816

Name of the Vulnerable Software and Affected Versions Cozmoslabs Paid Member Subscriptions versions 2.11.0 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2024-24867

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro versions 2.12.10 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations F...

PT-2024-24845

Name of the Vulnerable Software and Affected Versions Royal Elementor Kit versions 1.0.116 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the us...

PT-2024-24994

Name of the Vulnerable Software and Affected Versions WP ADA Compliance Check Basic versions 3.1.3 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application tha...

PT-2024-24880

Name of the Vulnerable Software and Affected Versions CoSchedule Headline Analyzer versions 1.3.3 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...