CVE-2024-5992: Missing Authorization

The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatechatbottoken' and 'updatechatbotposition' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to...

CVE-2024-5856: Missing Authorization

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-5704: Missing Authorization

The XPlainer – WooCommerce Product FAQ WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions i.e. ffwinsertnewfaq, ffwhidediscountnotice, ffwdeleteallfaqs, ffwdeletesinglefaq, etc... in all...

CVE-2024-5648: Missing Authorization

The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions i.e. wrldsetconfiguration, wrldexcludesettingssave, applytimetrackingsettings, wpajaxwrldgutenbergblockvisit, etc.. in all versions up to, and...

CVE-2024-4102: Missing Authorization

The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthoriz...

CVE-2024-3608: Missing Authorization

The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the productdesignerajaxdeleteattachid function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2024-5855: Missing Authorization

The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulkactiondelete and deletesingleimagecall AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for...

PT-2024-37298 · WordPress · Cliengo – Chatbot

Name of the Vulnerable Software and Affected Versions: The Cliengo – Chatbot plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to a missing capability check on the update session function, allowing authenticated attackers with Subscriber-level access and...

PT-2024-37297 · WordPress · Cliengo – Chatbot

Name of the Vulnerable Software and Affected Versions: The Cliengo – Chatbot plugin for WordPress versions up to, and including, 3.0.1 Description: The issue arises from a missing capability check on the update chatbot token and update chatbot position functions, allowing unauthorized modificatio...

PT-2024-36820 · WordPress · Learndash Lms – Reports

Name of the Vulnerable Software and Affected Versions: LearnDash LMS – Reports plugin for WordPress versions up to, and including, 1.8.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to update various plugin settings due to a missing capability check...

PT-2024-26888 · WordPress · Product Designer

Name of the Vulnerable Software and Affected Versions: Product Designer plugin for WordPress versions up to, and including, 1.0.33 Description: The issue is related to a missing capability check on the product designer ajax delete attach id function, which allows unauthorized loss of data. This...

PT-2024-29203 · WordPress · Pricing Table

Name of the Vulnerable Software and Affected Versions: Pricing Table plugin for WordPress versions up to, and including, 2.0.1 Description: The issue arises from a missing capability check on the ajax function, allowing authenticated attackers with subscriber-level access and above to perform...

Microsoft Windows Secure Boot Security Vulnerability

Microsoft Windows Secure Boot is a secure boot from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Secure Boot. An attacker exploiting this vulnerability could bypass certain features. The following products and editions are affected:Windows 10 Version 22H2 for...

Microsoft Windows Security Vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows LockDown Policy WLDP. An attacker exploiting the vulnerability could bypass certain features. The following products and versions are...

PT-2024-37363 · WordPress · Registration Forms

Name of the Vulnerable Software and Affected Versions: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress versions up to, and including, 3.8.3.4 Description: The issue allows authenticated...

PT-2024-36999 · Woocommerce · Xplainer - Woocommerce Product Faq

Name of the Vulnerable Software and Affected Versions: The XPlainer – WooCommerce Product FAQ WooCommerce Accordion FAQ Plugin versions up to, and including, 1.6.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without proper...

CVE-2024-6069: Missing Authorization

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregisterinstalladdon function in...

kernel: usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usbgetbosdescriptor' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usbgetbosdescriptor' encounters an iterati...

PT-2024-37194 · WordPress · Media Hygiene

Name of the Vulnerable Software and Affected Versions: Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to a missing capability check on the bulk action delete and delete single image call AJAX...

CVE-2024-5641

The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cedocorsavegeneralsetting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level...