WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Broken Authentication

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9861 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID...

Pixel Update Bulletin—October 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2024-10-05 or later address all issues in this bulletin and all issues in the October 2024 Android...

WordPress GiveWP Plugin <= 3.16.3 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.3 Fixed in 3.16.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-9634 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID a33794a83e6f Credits lefab Required privilege Unauthenticated...

WordPress Cooked Pro Plugin < 1.8.0 is vulnerable to Arbitrary File Upload

Software Cooked Pro Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49291 Patch priority High CVSS severity High 10 Developer Claim ownership PSID ca91d1c3c8bf Credits RE-ALTER Required privilege Unauthenticated...

WordPress Cooked Pro Plugin < 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Cooked Pro Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49289 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bde6da8a46e5 Credits RE-ALTER Required privilege Contributor...

WordPress CURCY Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Software CURCY Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49283 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a6bd022fc477 Credits Dimas Maulana Required privilege...

WordPress Point Maker Plugin <= 0.1.4 is vulnerable to Local File Inclusion

Software Point Maker Type Plugin Vulnerable versions = 0.1.4 Fixed in 0.1.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49317 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID c1446754dc54 Credits theviper17 Required privilege Contributor...

WordPress Click to Chat – WP Support All-in-One Floating Widget Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Click to Chat – WP Support All-in-One Floating Widget Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49281 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 953e712df67a Credits...

WordPress File Manager Pro Plugin <= 8.3.9 is vulnerable to Broken Access Control

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.9 Fixed in 8.3.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8746 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 037debfe30cc Credits TANG Cheuk Hei siunam...

WordPress ElementInvader Addons for Elementor Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software ElementInvader Addons for Elementor Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2293b37c11ea Credits Coli...

WordPress Job Board Manager for WordPress Plugin <= 1.0 is vulnerable to Privilege Escalation

Software Job Board Manager for WordPress Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-49322 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID d9004d540adc Credits João Pedro S...

WordPress Accordion Slider Plugin <= 1.9.11 is vulnerable to Cross Site Scripting (XSS)

Software Accordion Slider Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9582 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 14d97d769a8a Credits Muhammad Adel ItsFadi...

WordPress File Manager Pro Plugin <= 8.3.9 is vulnerable to Arbitrary File Upload

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.9 Fixed in 8.3.10 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-8918 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID 8b2de26c1b42 Credits TANG Cheuk Hei siunam Required privile...

WordPress Edwiser Bridge Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Edwiser Bridge Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49311 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 21963ed8844c Credits Muhammad Daffa Required privilege...

Supply Chain Attacks Can Exploit Entry Points in Python, npm, and Open-Source Ecosystems

Cybersecurity researchers have found that entry points could be abused across multiple programming ecosystems like PyPI, npm, Ruby Gems, NuGet, Dart Pub, and Rust Crates to stage software supply chain attacks. "Attackers can leverage these entry points to execute malicious code when specific...

Rockwell Automation多款产品 安全漏洞

Rockwell Automation RSLogix 500 and others are products of Rockwell Automation, a U.S. company.Rockwell Automation RSLogix 500 is a suite of programming software for industrial control systems.Rockwell Automation Rockwell Automation RSLogix Micro Developer and Starter is an industrial control...

WordPress Better Author Bio Plugin <= 2.7.10.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Better Author Bio Type Plugin Vulnerable versions = 2.7.10.11 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49229 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dd031bce3db6 Credits SOPROBRO...

WordPress Plexx Elementor Extension Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Plexx Elementor Extension Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49234 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d2192b71a7de Credits Khalid Yusuf Required...

WordPress WP Post Author Plugin <= 3.8.1 is vulnerable to SQL Injection

Software WP Post Author Type Plugin Vulnerable versions = 3.8.1 Fixed in 3.8.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8757 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 459e7e4ad115 Credits Lesor101 Required privilege Administrator Published...

WordPress Order Attachments for WooCommerce Plugin 2.0 - 2.4.1 is vulnerable to Broken Access Control

Software Order Attachments for WooCommerce Type Plugin Vulnerable versions 2.0 - 2.4.1 Fixed in 2.5.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9756 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dca315263a7c Credits luckynoo...