Flaw in Elementor and Beaver Addons Let Anyone Hack WordPress Sites

Attention WordPress users! Your website could easily get hacked if you are using "Ultimate Addons for Beaver Builder ," or "Ultimate Addons for Elementor " and haven't recently updated them to the latest available versions. Security researchers have discovered a critical yet easy-to-exploit...

WordPress Ultimate Addons for Elementor plugin <= 1.20.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability found by MalCare in WordPress Ultimate Addons for Elementor plugin versions = 1.20.0. Solution Update the WordPress Ultimate Addons for Elementor plugin to the latest available version at least 1.20.1...

WordPress Ultimate Addons for Beaver Builder plugin <= 1.24.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability found by MalCare in WordPress Ultimate Addons for Beaver Builder plugin versions = 1.24.0. Solution Update the WordPress Ultimate Addons for Beaver Builder plugin to the latest available version at least 1.24.1...

CVE-2005-2352

I race condition in Temp files was found in gs-gpl before 8.56 addons scripts...

CVE-2005-2352

I race condition in Temp files was found in gs-gpl before 8.56 addons scripts...

CVE-2005-2352

I race condition in Temp files was found in gs-gpl before 8.56 addons scripts...

PT-2019-6476

Name of the Vulnerable Software and Affected Versions gs-gpl versions prior to 8.56 Description A race condition in temporary files was found in the addons scripts of gs-gpl. Recommendations For versions prior to 8.56, update to version 8.56 or later to resolve the issue...

USN-4122-2: Firefox regression

USN-4122-1 fixed vulnerabilities in Firefox. The update caused a regression that resulted in a crash when changing YouTube playback speed in some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered i...

CVE-2019-11741

A compromised sandboxed content process can perform a Universal Cross-site Scripting UXSS attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these site...

USN-4122-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy CSP protections, bypass same-origin restrictions, conduct cross-site...

UBUNTU-CVE-2019-11741

A compromised sandboxed content process can perform a Universal Cross-site Scripting UXSS attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these site...

CVE-2019-15564

The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partnercompassion.py...

CVE-2019-15564: Improper Neutralization of Special Elements used in an SQL Command

The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partnercompassion.py...

PT-2019-14280

Name of the Vulnerable Software and Affected Versions Compassion Switzerland addons version 10.01.4 for Odoo Description The issue allows SQL injection in the models/partner compassion.py file. Recommendations For version 10.01.4, update to a newer version that contains a fix for this issue...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

Improper access control

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2019-9584

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages...

Design/Logic Flaw

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...

CVE-2019-14984

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...