9779 matches found
WordPress The Events Calendar plugin <= 6.6.4 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Foxyyy in WordPress Plugin The Events Calendar versions = 6.6.4...
CVE-2024-8275
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-8275
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-8275 The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-8275
The Events Calendar (WordPress plugin) is affected by CVE-2024-8275: an unauthenticated SQL injection via the order parameter in tribe_has_next_event() that affects all versions up to 6.6.4. The issue stems from insufficient escaping of user input and inadequate SQL query preparation, allowing an...
CVE-2024-8476
The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeeventpluginbuttons function. This makes it possible for unauthenticated attackers to delete arbitrary...
CVE-2024-8476
CVE-2024-8476 affects the Easy PayPal Events plugin for WordPress (versions
CVE-2024-8476 Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeeventpluginbuttons function. This makes it possible for unauthenticated attackers to delete arbitrary...
WordPress The Events Calendar Plugin <= 6.6.4 is vulnerable to SQL Injection
Software The Events Calendar Type Plugin Vulnerable versions = 6.6.4 Fixed in 6.6.4.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8275 Patch priority High CVSS severity High 9.3 Developer Liquid Web / StellarWP PSID fcc27b88891b Credits Foxyyy Required privilege...
Concrete CMS 跨站脚本漏洞
Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A cross-site scripting vulnerability exists in Concrete CMS versions 9.0.0 through 9.3.3 and prior to 8.5.19. The vulnerability stems from the calendar event names not being cleaned up during...
WordPress plugin Easy PayPal Events 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
WordPress plugin The Events Calendar SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability...
WordPress Easy PayPal Events plugin <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion vulnerability
Cross-Site Request Forgery to Arbitrary Post Deletion vulnerability discovered by Krzysztof Zając in WordPress Plugin Easy PayPal Events versions = 1.2.1...
WordPress Google Calendar Events plugin <= 3.4.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Google Calendar Events versions = 3.4.2...
kernel: mlxsw: spectrum: Protect driver from buggy firmware
A vulnerability was found in the Linux kernel's mlxsw spectrum driver, where processing port up/down events leads to a NULL pointer dereference. This issue occurs when the driver fails to handle events for the CPU port, which exists but lacks a corresponding network device, resulting in system...
kernel: ice: Fix improper extts handling
A vulnerability was found in the Linux kernel's ethernet ice driver, where EXTTS events are improperly handled. If the driver is removed while the managing application is running, certain EXTT events might remain enabled. This issue can lead to system instability and crashes...
kernel: perf: Fix list corruption in perf_cgroup_switch()
A vulnerability was found in the Linux kernel's performance monitoring subsystem, where the perfcgroupswitch function can lead to list corruption on the cgrpcpuctxlist. This occurs during the iteration of the list when an entry is removed using perfcgroupeventdisable, which does not safely handle...
kernel: ice: Fix improper extts handling
A vulnerability was found in the Linux kernel's ethernet ice driver, where EXTTS events are improperly handled. If the driver is removed while the managing application is running, certain EXTT events might remain enabled. This issue can lead to system instability and crashes...
WordPress Google Calendar Events Plugin <= 3.4.2 is vulnerable to Cross Site Scripting (XSS)
Software Google Calendar Events Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f01a635ec08 Credits vgo0 Requir...
WordPress Easy PayPal Events Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Easy PayPal Events Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8476 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 61a92fe21d38 Credits Krzysztof Zając...