CVE-2024-43131

Incorrect Authorization vulnerability in WPWeb Docket WooCommerce Collections / Wishlist / Watchlist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket WooCommerce Collections / Wishlist / Watchlist: from n/a before 1.7.0...

CVE-2024-43131

Incorrect Authorization vulnerability in WPWeb Docket WooCommerce Collections / Wishlist / Watchlist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket WooCommerce Collections / Wishlist / Watchlist: from n/a before 1.7.0...

CVE-2024-43131 WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability

Incorrect Authorization vulnerability in WPWeb Docket WooCommerce Collections / Wishlist / Watchlist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket WooCommerce Collections / Wishlist / Watchlist: from n/a before 1.7.0...

PT-2024-30320

Name of the Vulnerable Software and Affected Versions Docket WooCommerce Collections / Wishlist / Watchlist versions prior to 1.7.0 Description The issue is related to an Incorrect Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists...

WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin <= 1.6.6 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Docket WooCommerce Collections / Wishlist / Watchlist versions 1.7.0...

WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion vulnerability

Unauthenticated Arbitrary Post/Page Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Docket WooCommerce Collections / Wishlist / Watchlist versions 1.7.0...

WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) Plugin < 1.7.0 is vulnerable to Arbitrary Content Deletion

Software Docket WooCommerce Collections / Wishlist / Watchlist Type Plugin Vulnerable versions 1.7.0 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-43131 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID...

WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) Plugin < 1.7.0 is vulnerable to SQL Injection

Software Docket WooCommerce Collections / Wishlist / Watchlist Type Plugin Vulnerable versions 1.7.0 Fixed in 1.7.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43132 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 952a5b0e08da Credits Dave Jong...

Ubuntu 14.04 LTS : Apache Commons Collections vulnerability (USN-6936-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6936-1 advisory. It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to...

USN-6936-1 libcommons-collections3-java vulnerability

It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to execute arbitrary code...

USN-6936-1: Apache Commons Collections vulnerability

It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by default. A remote attacker could possibly use this issue to execute arbitrary code...

[SECURITY] Fedora 39 Update: python3.6-3.6.15-29.fc39

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.19.1 that stems from the fact that when a super administrator creates a collection in which the items in the collection are associated with another collection, another user with t...

Fedora: Security Advisory (FEDORA-2024-a702b78744)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-4812

A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections...

CVE-2024-4812

The CVE-2024-4812 entries describe a stored cross-site scripting (XSS) vulnerability in the Katello plugin for Foreman, where malicious JavaScript can be saved in a user Description field and executed when loading pages such as Host Collections. Root cause: insufficient input sanitization of the ...

CVE-2024-4812 Katello: potential cross-site scripting exploit in ui

A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections...

CVE-2024-4812

A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections...

Cross-site Scripting (XSS)

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper sanitization of the Description field in the user interface. An attacker can execute arbitrary JavaScript code by...

CVE-2024-3584

CVE-2024-3584 affects qdrant/qdrant (version 1.9.0-dev) and is caused by improper input validation in the /collections/{name}/snapshots/upload endpoint, enabling path traversal via URL-encoded name to write/overwrite arbitrary files (e.g., /root/poc.txt). The vulnerability can lead to full system...