Important: java-11-openjdk

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...

PT-2024-17547 · WordPress · File Manager Pro – Filester +1

Name of the Vulnerable Software and Affected Versions: File Manager Pro – Filester plugin for WordPress versions up to, and including, 1.8.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to install the Filebird plugin due to a missing capability chec...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...

CVE-2024-11926

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...

CVE-2024-11926 Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...

PT-2024-17349 · WordPress · The Travel Booking Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Travel Booking WordPress Theme versions up to, and including, 3.1.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without permission due to a missing capability check on several...

CVE-2024-11926: Missing Authorization

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...

CVE-2024-55231: Authorization Bypass Through User-Controlled Key

An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belonging to other accounts due to missing authorization checks. This flaw exposes sensitive data and enables attackers to alter another user's...

WPForms Plugin Unauthorized Access

The vulnerability of the wpformsisadminpage function in the WPForms plugin related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read and modify data...

AMD Data Protection Violation

The vulnerability of AMD’s microprogrammed software lies in the bypass of the data protection mechanism. Exploiting this vulnerability allows an attacker to circumvent the SPI ROM protection mechanism by modifying the data...

CVE-2024-10476: Use of Default Credentials

Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information PHI and personally identifiable information PII. Exploitation of this...

PT-2024-36630

Name of the Vulnerable Software and Affected Versions Code Generator Pro versions n/a through 1.2 Description The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This is a type of attack where an attacker can inject malicious SQL...

CVE-2024-11724

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

CVE-2024-11724

CVE-2024-11724 concerns the WordPress plugin Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (GDPR/CCPA/ePrivacy). The issue is described as a missing capability check on the wpl_script_save AJAX action in all versions up to and including 3.6.5, enabling authen...

CVE-2024-12263

The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clouddelete and cloudupdate functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12263

CVE-2024-12263 affects the WordPress plugin Child Theme Creator by Orbisius . The issue is a missing capability check in the cloud_delete() and cloud_update() functions, enabling authenticated attackers with Subscriber-level access and above to modify or delete cloud snippets. The vulnerability w...

CVE-2024-11709

The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aipostgeneratordeletePost AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with...

CVE-2024-11709

CVE-2024-11709 concerns the WordPress plugin AI Post Generator | AutoWriter. The vulnerability stems from a missing capability check on the ai_post_generator_delete_Post AJAX action, affecting all versions up to 3.5. The flaw enables authenticated attackers with Contributor-level access or higher...

CVE-2024-11443 de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update

The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debrandingsave function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with...

CVE-2024-12341

CVE-2024-12341 affects the WordPress plugin Custom Skins Contact Form 7 (up to v1.0). The root cause is a missing capability check in the cf7cs_action_callback function, allowing authenticated users with Subscriber-level access or higher to modify data. The impact, as described in public CVE note...