CVE-2024-32771: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via...

PT-2024-21663 · Helpdesk · Helpdesk

Name of the Vulnerable Software and Affected Versions: Helpdesk versions prior to 3.3.1 Description: A cross-site scripting XSS vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network...

PT-2024-19116 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An OS command injection issue has been reported to affect several QNAP operating system versions. If exploited, the...

CVE-2024-6311

The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2addfont' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to...

WordPress Funnelforms Free plugin <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability

Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by István Márton in WordPress Plugin Funnelforms Free versions = 3.7.3.2...

CVE-2024-7777

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes i...

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion vulnerability

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated Administrator+ Arbitrary File Read And Deletion vulnerability discovered by siunam in WordPress Plugin Bit Form versions 2.0 - 2.13.9...

CVE-2024-32765 QTS, QuTS hero

A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-32765 QTS, QuTS hero

A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-32765

CVE-2024-32765 affects QNAP Network & Virtual Switch, with fixed releases in QTS 5.1.8.2823 build 20240712 and later and QuTS hero h5.1.8.2823 build 20240712 and later. A locally authenticated administrator can gain access to and execute certain functions via unspecified vectors; the exact exploi...

WordPress WP Mail SMTP plugin <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure vulnerability

Authenticated Admin+ SMTP Password Exposure vulnerability discovered by Guus Verbeek in WordPress Plugin WP Mail SMTP by WPForms versions = 4.0.1...

WordPress Cost Calculator Builder plugin <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Guido Iván García in WordPress Plugin Cost Calculator Builder versions = 3.2.12...

PT-2024-37314 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder plugin for WordPress versions up to, and including, 3.2.12 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Administrator-level access and...

PT-2024-8591 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 November Security Update Ivanti Endpoint Manager versions prior to 2022 SU6 November Security Update Description: The issue is related to SQL injection in Ivanti Endpoint Manager, which can be...

WordPress Nafeza Prayer Time plugin <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Nafeza Prayer Time versions = 1.2.9...

WordPress Automatic Translator with Google Translate plugin <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Custom Font vulnerability discovered by emad in WordPress Plugin Automatic Translator with Auto Translate versions = 1.5.4...

WordPress Advanced Ads plugin <= 1.52.1 - Authenticated (Admin+) PHP Object Injection vulnerability

Authenticated Admin+ PHP Object Injection vulnerability discovered by ST in WordPress Plugin Advanced Ads versions = 1.52.1...

CVE-2023-47220

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5...

CVE-2023-47220

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5...

CVE-2023-47220

The CVE-2023-47220 issue affects the Media Streaming add-on prior to version 500.1.1.5. It describes an OS command injection vulnerability that could allow an authenticated administrator to execute commands over the network. The fixed release is Media Streaming add-on 500.1.1.5 (2024-01-22) and l...