4212 matches found
CVE-2024-2302
The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via...
CVE-2024-2302
The CVE-2024-2302 entry concerns Easy Digital Downloads – Sell Digital Files & Subscriptions for WordPress. It describes an Information Disclosure vulnerability in all versions up to 3.2.9, allowing unauthenticated attackers to download the plugin’s debug log via Directory Listing, potentially ex...
PT-2024-19637 · WordPress · Easy Digital Downloads
Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – Sell Digital Files & Subscriptions plugin for WordPress versions up to, and including, 3.2.9 Description: The issue allows unauthenticated attackers to download the debug log via Directory Listing, potentially exposin...
The vulnerability of the SMC Downloads function in the Forcepoint NGFW Security Management Center web application allows attackers to execute cross-site scripting attacks.
The vulnerability of the SMC Downloads function in the Forcepoint NGFW Security Management Center web application relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site attacks...
The vulnerability of the Downloads component of the Google Chrome web browser allows a hacker to replace the user interface.
The vulnerability of the Downloads component in the Google Chrome web browser is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to replace the user interface through a specially created URL address...
WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Easy Digital Downloads versions = 3.2.6...
WordPress Easy Digital Downloads Plugin <= 3.2.6 is vulnerable to Cross Site Request Forgery (CSRF)
Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31293 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89807a8f40a1 Credits Dhabaleshwar...
WordPress Easy Digital Downloads plugin <= 3.2.9 - Sensitive Information Exposure vulnerability
Sensitive Information Exposure vulnerability discovered by Colin Xu in WordPress Plugin Easy Digital Downloads versions = 3.2.9...
WordPress Easy Digital Downloads Plugin <= 3.2.9 is vulnerable to Sensitive Data Exposure
Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.9 Fixed in 3.2.10 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4b720db13b09 Credits Colin Xu Required...
Moderate: Red Hat Security Advisory: curl security and bug fix update
An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
VulnCheck KEV: CVE-2024-27954
The WordPress Automatic Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery and Arbitrary File Downloads in all versions up to, and including, 3.92.0. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...
ROS-20240329-07
A vulnerability in the Picture-in-Picture PiP technology of the Google Chrome browser is related to errors in the presentation of errors in the presentation of information by the user interface. Exploitation of the vulnerability could allow an attacker, acting remotely, to conduct spoofing attack...
Stories from the SOC Part 1: IDAT Loader to BruteRatel
Rapid7’s Managed Detection and Response MDR team continuously monitors our customers' environments, identifying emerging threats and developing new detections. In August 2023, Rapid7 identified a new malware loader named the IDAT Loader. Malware loaders are a type of malicious software designed t...
CVE-2024-2209
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility FUU bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution...
CVE-2024-2209
HP DeskJet printers are affected by CVE-2024-2209 in the Printer Firmware Update Utility (FUU) bundle. A user with administrative privileges can replace the original DLL in the FUU bundle with a malicious DLL of the same name and place it in the Windows default downloads directory, potentially ca...
UBUNTU-CVE-2024-29203
TinyMCE is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by...
PT-2024-2665 · Microsoft +1 · Windows +1
Name of the Vulnerable Software and Affected Versions: HP Printer's Firmware Update Utility FUU bundle affected versions not specified Description: The issue is related to an uncontrolled search path element in the HP printer's Firmware Update Utility FUU bundle. A user with administrative...
CVE-2024-1231
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack...