CVE-2024-7259

The CVE-2024-7259 entry covers a vulnerability in oVirt-engine where an administrator (including ReadOnlyAdmin) can view provider credentials in cleartext via browser developer tools. Affected product: oVirt-engine (as described in CVE context); root cause: exposure of provider passwords via the ...

CVE-2024-7259 Ovirt-engine: potential exposure of cleartext provider passwords via web ui

A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext...

CVE-2024-47197 Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...

oVirt Node 安全漏洞

oVirt Node is an open source virtualization management platform. A security vulnerability exists in oVirt Node that stems from the fact that a user with administrator privileges may be able to view provider passwords in plaintext using browser developer tools...

A Bootiful Podcast: Oracle Java Developer Advocate Billy Korando on Java 23, Structured Concurrency, and more

Hi, Spring fans! In this installment I talk to Java Developer advocate at Oracle, Billy Korando, about the amazing new features in Java 23 and beyond!...

WordPress ProfileGrid Plugin <= 5.9.3.2 is vulnerable to Cross Site Scripting (XSS)

Software ProfileGrid Type Plugin Vulnerable versions = 5.9.3.2 Fixed in 5.9.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8861 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 907c16cddd3d Credits Francesco Carlucci...

PT-2024-38216 · Ovirt · Ovirt

Name of the Vulnerable Software and Affected Versions: oVirt affected versions not specified Description: A flaw was found in oVirt, allowing a user with administrator privileges, including those with the ReadOnlyAdmin permission, to potentially view Provider passwords in cleartext using browser...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.34 is vulnerable to Broken Access Control

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.34 Fixed in 5.7.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8771 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d3427c89899f Credits Michelle...

WordPress Multi Step for Contact Form Plugin <= 2.7.7 is vulnerable to SQL Injection

Software Multi Step for Contact Form Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47331 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a27c5e08d690 Credits Hakiduck Required privilege...

WordPress JupiterX Core Plugin <= 4.7.5 is vulnerable to Broken Authentication

Software JupiterX Core Type Plugin Vulnerable versions = 4.7.5 Fixed in 4.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-7781 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 4950f50fad7a Credits Geo Void...

CVE-2024-7259: Cleartext Storage of Sensitive Information

A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext...

WordPress WS Form LITE Plugin <= 1.9.238 is vulnerable to Cross Site Scripting (XSS)

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.238 Fixed in 1.9.244 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47320 Patch priority Medium CVSS severity Medium 7.1 Developer WS Form PSID cb1829e55bbc Credits savphill Required privilege...

WordPress WP ULike Plugin < 4.7.4 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.4 Fixed in 4.7.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7878 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6efbbe7dce64 Credits Bob Matyas Required privilege...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.13.10 is vulnerable to Arbitrary File Upload

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.13.10 Fixed in 2.13.11 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-47319 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID 4ad1bd9ca230 Credits Certus Cybersecurity...

WordPress WP Datepicker Plugin <= 2.1.1 is vulnerable to Broken Access Control

Software WP Datepicker Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47321 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 43063696ef76 Credits Mika Required privilege...

WordPress Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Plugin <= 2.0.84 is vulnerable to Broken Access Control

Software Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Type Plugin Vulnerable versions = 2.0.84 Fixed in 2.0.85 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47317 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3ea101b7f4e3...

WordPress Use Any Font Plugin <= 6.3.08 is vulnerable to Cross Site Request Forgery (CSRF)

Software Use Any Font Type Plugin Vulnerable versions = 6.3.08 Fixed in 6.3.09 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-47305 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15cf8c1d7c9e Credits Rafie Muhammad...

WordPress Ninja Forms Plugin <= 3.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.15 Fixed in 3.8.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3866 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8846b83daea8 Credits wesley wcraft Required...

WordPress GEO my WordPress Plugin <= 4.5.0.3 is vulnerable to Cross Site Scripting (XSS)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.5.0.3 Fixed in 4.5.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47327 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ae4773f8057e Credits Le Ngoc Anh Required...

WordPress Uncanny Groups for LearnDash Plugin <= 6.1.0.1 is vulnerable to Privilege Escalation

Software Uncanny Groups for LearnDash Type Plugin Vulnerable versions = 6.1.0.1 Fixed in 6.1.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8349 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 0a9f41b67f...