WordPress Orchid Store Theme <= 1.5.6 is vulnerable to Broken Access Control

Software Orchid Store Type Theme Vulnerable versions = 1.5.6 Fixed in 1.5.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6987 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 11ea3d6423d2 Credits Lucio Sá Required privilege...

WordPress Event Manager for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43138 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 721149c5cd33 Credits João Pedro S...

WordPress Sunshine Photo Cart Plugin <= 3.2.1 is vulnerable to Broken Access Control

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43136 Patch priority Low CVSS severity Low 4.3 Developer WP Sunshine PSID e9fdd2719690 Credits Manab Jyoti Dowarah Required...

WordPress Graphina Plugin <= 1.8.10 is vulnerable to Cross Site Scripting (XSS)

Software Graphina Type Plugin Vulnerable versions = 1.8.10 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43124 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 730b126f8b88 Credits Khalid Yusuf Required privilege Contributor...

WordPress Spectra Plugin <= 2.14.1 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.14.1 Fixed in 2.15.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-7590 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a51e418171d1 Credits João Pedro S Alcântara Kinorth Required...

WordPress WPSection Plugin <= 1.3.8 is vulnerable to Local File Inclusion

Software WPSection Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43165 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cd0a6805dc6f Credits João Pedro S Alcântara Kinorth Required privileg...

WordPress Xpro Elementor Addons Plugin <= 1.4.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.4.2 Fixed in 1.4.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43150 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 53be3ecd3562 Credits Khalid Yusuf Required...

WordPress Football Pool Plugin <= 2.11.10 is vulnerable to Cross Site Scripting (XSS)

Software Football Pool Type Plugin Vulnerable versions = 2.11.10 Fixed in 2.12.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43130 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 286c38961ee5 Credits Ananda Dhakal Patchstack Required...

WordPress Ultimate Bootstrap Elements for Elementor Plugin <= 1.4.4 is vulnerable to Local File Inclusion

Software Ultimate Bootstrap Elements for Elementor Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43140 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 5eacd8a2c878 Credits...

WordPress Advanced Cron Manager – debug & control Plugin <= 2.5.9 is vulnerable to Broken Access Control

Software Advanced Cron Manager – debug & control Type Plugin Vulnerable versions = 2.5.9 Fixed in 2.5.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7331ca5ca4a8 Credits...

WordPress Modern Events Calendar Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 2c1730c6aa47 Credits Foxyyy Required...

CVE-2024-7246

A flaw was found in Google gRPC due to HPACK table poisoning between the proxy and backend so that other clients see failed requests, resulting in a denial of service. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent...

CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

CVE-2024-6203

HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users given their email address is known. When these poisoned links get accessed e.g. manually by the victim or automatically by an email client...

SUSE CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

WordPress WPBakery Page Builder Plugin <= 7.7 is vulnerable to Local File Inclusion

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.7 Fixed in 7.8 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5709 Patch priority Low CVSS severity Low 6.6 Developer WPBakery PSID 1374f7b043bd Credits João Pedro Soares de Alcântara Required privileg...

WordPress Easy Table of Contents Plugin < 2.0.68 is vulnerable to Cross Site Scripting (XSS)

Software Easy Table of Contents Type Plugin Vulnerable versions 2.0.68 Fixed in 2.0.68 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7082 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d82cde2e0050 Credits Dmitrii Ignatyev...