CVE-2024-11354

CVE-2024-11354 concerns the WordPress plugin “Ultimate YouTube Video & Shorts Player With Vimeo”. The vulnerability affects all versions up to and including 3.3 and stems from a missing capability check in the del_ytsingvid() function, enabling authenticated attackers with Subscriber-level access...

Unspecified vulnerability in Linux kernel (CNVD-2024-46440)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not properly checking the encoder in intelhdcp2getcapability.No details of the vulnerability are provided at...

The vulnerability of the hci_event component in the Linux operating system’s kernel allows a perpetrator to gain access to confidential information.

The vulnerability of the hcievent component in the Linux operating system’s kernel is related to the disclosure of information within the hciiocaparequestevt function. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

GHSA-J822-X5GG-5R56 Moodle allows users to retrieve information they did not have permission to access

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access...

CVE-2024-10520

The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'CreateMilestone', 'CreateTaskList', 'CreateTask', and 'DeleteTask' classes in version 2.6.14. This makes it possible for unauthenticated...

CVE-2024-10520 WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion

The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'CreateMilestone', 'CreateTaskList', 'CreateTask', and 'DeleteTask' classes in version 2.6.14. This makes it possible for unauthenticated...

CVE-2024-45689

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access...

UBUNTU-CVE-2024-45689

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access...

CVE-2024-45689

CVE-2024-45689 describes an access-control flaw in Moodle where dynamic tables did not enforce capability checks, allowing users to retrieve information they should not access. Multiple connected sources (OSV/GHSA entries, Nessus/NASL references) corroborate the impact as unprotected access to se...

CVE-2024-45689 Moodle: unprotected access to sensitive information via dynamic tables

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access...

CVE-2024-10665

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpayviewlogcallback and yaadpaydeletelogcallback functions in all versions up to, and including, 2.2.4. This makes it possible for...

CVE-2024-10665

The CVE-2024-10665 entry concerns the Yaad Sarig Payment Gateway For WC WordPress plugin. The connected documents confirm a root cause: a missing capability check in the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions, allowing authenticated attackers with Subscriber-level...

CVE-2024-10665 Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpayviewlogcallback and yaadpaydeletelogcallback functions in all versions up to, and including, 2.2.4. This makes it possible for...

CVE-2024-10900

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmremovefileattachment function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attacker...

CVE-2024-10900

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmremovefileattachment function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attacker...

CVE-2024-10900

CVE-2024-10900 affects the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The issue is a Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion due to a missing capability check in pm_remove_file_attachment(). Affected versions are all up to a...

CVE-2024-10900 ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmremovefileattachment function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attacker...

SUSE CVE-2024-53050

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: Add encoder check in hdcp2getcapability Add encoder check in intelhdcp2getcapability to avoid null pointer error...

PT-2024-16441 · WordPress · Yaad Sarig Payment Gateway For Wc

Name of the Vulnerable Software and Affected Versions: Yaad Sarig Payment Gateway For WC plugin for WordPress versions up to, and including, 2.2.4 Description: The issue is related to a missing capability check on the yaadpay view log callback and yaadpay delete log callback functions. This allow...

PT-2024-16929 · WordPress · The Ultimate Youtube Video & Shorts Player With Vimeo

Name of the Vulnerable Software and Affected Versions: The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress versions up to, and including, 3.3 Description: The issue is related to a missing capability check on the del ytsingvid function, allowing authenticated attackers with...