CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.8...

CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

CVE-2024-53738

CVE-2024-53738 describes a Server-Side Request Forgery (SSRF) in the WordPress plugin Asset CleanUp: Page Speed Booster, affected versions are up to 1.3.9.8. The CVE entry notes a MEDIUM severity with CVSSv3.1 base score 4.4 and that the vulnerability affects authenticated users (admin+). Connect...

PT-2024-35846 · WordPress · Asset Cleanup: Page Speed Booster

Name of the Vulnerable Software and Affected Versions: Asset CleanUp: Page Speed Booster versions 1.3.9.8 and earlier Description: A Server-Side Request Forgery SSRF issue affects the Asset CleanUp: Page Speed Booster plugin, allowing an attacker to perform Server Side Request Forgery. This could...

WordPress plugin Asset CleanUp: Page Speed Booster code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2024-53738: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

Dell UPnP SUBSCRIBE function Incorrect Default Permissions (CVE-2020-12695)

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. This plugin only works with Tenable.ot...

SiYuan security vulnerabilities

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A security vulnerability exists in SiYuan version 3.1.11, which stems from an SQL injection vulnerability contained in the id parameter of the /getAssetContent file...

WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Zaidan Rizaki Patchstack Alliance in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.3.9.8...

Is Bitcoin Still a Secure and Reliable Trading Option?

Cryptocurrencies are a relatively new asset class, and over the years, they have continued to be the subject…...

Directory Traversal

statamic/cms is vulnerable to Directory Traversal. The vulnerability is due to improperly handled filenames in asset uploads, which could allow files to be placed in unintended locations on the server, potentially overriding existing files...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Monitor

Summary IBM WebSphere Application Server is shipped as a component of Business Monitor. Information about the security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

GHSA-P7F6-8MCM-FWV3 Statamic CMS has a Path Traversal in Asset Upload

Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. Impact - Affects front-end forms with assets fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. -...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the asset upload functionality. An attacker can place files in unintended locations on the server by uploading files with specially crafted filenames. Details A Directory Traversal attack also known as path...

Statamic CMS has a Path Traversal in Asset Upload

Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. Impact - Affects front-end forms with assets fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. -...

CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2024-52600: Improper Limitation of a Pathname to a Restricted Directory

Statmatic is a Laravel and Git powered content management system CMS. Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with assets fields and other plac...

CVE-2024-43416 GLPI vulnerable to enumeration of users' email addresses by unauthenticated user

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue...