751 matches found
CVE-2024-1217
CVE-2024-1217 affects the Kali Forms WordPress plugin (Contact Form builder with drag & drop). The vulnerability arises from a missing capability check in the await_plugin_deactivation function across versions up to 2.3.41, allowing authenticated users with subscriber access or higher to deactiva...
CVE-2024-1217 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the awaitplugindeactivation function in all versions up to, and including, 2.3.41. This makes it possible for...
PT-2024-17468 · WordPress · Kali Forms
Name of the Vulnerable Software and Affected Versions: Kali Forms plugin for WordPress versions up to, and including, 2.3.41 Description: The issue arises from a missing capability check on the await plugin deactivation function, allowing authenticated attackers with subscriber access or higher t...
Contact Form builder with drag & drop for WordPress – Kali Forms < 2.3.42 - Missing Authorization to Arbitrary Plugin Deactivation
Description The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the awaitplugindeactivation function in all versions up to, and including, 2.3.41. This makes it possible fo...
kernel: use after free in nft_immediate_deactivate
A use-after-free flaw was found in the Linux kernel's netfilter: nftables component, which can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nftimmediatedeactivate can unbind the chain and objects can be...
1 click disable all < 1.0.2 - Plugins Deactivation via CSRF
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation, allowing unauthenticated attackers to deactivate all plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...
PT-2023-8117
Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivate...
Design/Logic Flaw
A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nftpipapowalk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO Pile Packet Policies elements, leadi...
GiveWP < 2.33.4 - Cross-Site Request Forgery to Stripe Integration Deletion
Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givestripedisconnectconnectstripeaccount function. This makes it possible for unauthenticated attackers to...
GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin deactivation
Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendW...
kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter
A use-after-free vulnerability was found in the traffic control index filter tcindex in the Linux kernel. The tcindexdelete does not properly deactivate filters, which can later lead to double freeing the structure. This flaw allows a local attacker to cause a use-after-free problem, leading to...
Cross site request forgery (csrf)
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the query on XWiki tool allows executing arbitrary database queries on the database of the XWiki installation. Among other things, this allow...
Profile Builder < 3.10.4 - Plugins Activation/Deactivation CSRF
Description The plugin does not have CSRF checks when activating and deactivating plugins, which could allow attackers to make logged in users perform such actions via CSRF attacks...
Design/Logic Flaw
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...
CVE-2023-46249 authentik potential installation takeover when default admin user is deleted
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...
Design/Logic Flaw
IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607...
PT-2023-7180 · Ibm · Ibm Db2
Name of the Vulnerable Software and Affected Versions: IBM Db2 version 11.5 Description: The issue exists due to insufficient input validation in the system, allowing an attacker to cause a denial of service. A local user with special privileges can exploit this during database deactivation on DP...
CVE-2023-5449
A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated...
CVE-2023-5449
A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated...
Design/Logic Flaw
A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated...