GitHub: Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)

A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to retrieve metadata information of a user who clicks on an uploaded malicious asset URL. The vulnerability affected all versions prior to 3.14 and was fixed in later versions...

CVE-2024-34360

go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an...

CVE-2024-27280

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fix...

UBUNTU-CVE-2024-27281

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler it is possible to extract arbitrary heap data relative to the start of the text including pointers and sensitive strings. The fixed versions are 3.0.7 3.1.5 3.2.4 and 3.3.1.

...

WordPress Graphina Plugin <= 1.8.9 is vulnerable to Cross Site Scripting (XSS)

Software Graphina Type Plugin Vulnerable versions = 1.8.9 Fixed in 1.8.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4574 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 937e343a9f16 Credits stealthcopter Required privile...

WordPress Falang multilanguage Plugin <= 1.3.49 is vulnerable to Cross Site Scripting (XSS)

Software Falang multilanguage Type Plugin Vulnerable versions = 1.3.49 Fixed in 1.3.50 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4417 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f66544b43c9b Credits Benedictus Jovan...

PT-2024-30843 · WordPress · Html5 Audio Player

Name of the Vulnerable Software and Affected Versions: The HTML5 Audio Player- Best WordPress Audio Player Plugin versions up to, and including, 2.2.19 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets,...

WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Cross Site Scripting (XSS)

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4277 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3ad5ee25dcd1 Credits stealthcopter Required...

WordPress Extra Theme <= 4.25.0 is vulnerable to Cross Site Scripting (XSS)

Software Extra Type Theme Vulnerable versions = 4.25.0 Fixed in 4.25.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4490 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bcfad4f5bb49 Credits Webbernaut Required privilege...

WordPress White Label CMS Plugin <= 2.7.3 is vulnerable to Broken Access Control

Software White Label CMS Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4280 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a368614cfe17 Credits Krzysztof Zając Required...

WordPress Z-Downloads Plugin <= 1.11.3 is vulnerable to Arbitrary File Upload

Software Z-Downloads Type Plugin Vulnerable versions = 1.11.3 Fixed in 1.11.4 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-34555 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID b00ddc85506e Credits younsoung kim, SeoHyeon Lee, MyungJu Kim,...

WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Broken Access Control

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4444 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5f824fed280f Credits 1337Wannabe Required privilege...

WordPress Hotel Booking Lite Plugin <= 4.11.1 is vulnerable to PHP Object Injection

Software Hotel Booking Lite Type Plugin Vulnerable versions = 4.11.1 Fixed in 4.11.2 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4413 Patch priority High CVSS severity High 9 Developer Claim ownership PSID f9d7cef7773f Credits Trinh Vu Sonicrrrr Required privilege...

WordPress Easy Digital Downloads Plugin <= 3.2.11 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.11 Fixed in 3.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c5d829b14d8d Credits Dhabaleshwar D...

WordPress Meow Gallery Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Meow Gallery Type Plugin Vulnerable versions = 5.1.3 Fixed in 5.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4386 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff273a246878 Credits Krzysztof Zając Required...

WordPress Swift Performance Lite Plugin <= 2.3.6.18 is vulnerable to Broken Access Control

Software Swift Performance Lite Type Plugin Vulnerable versions = 2.3.6.18 Fixed in 2.3.6.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3722 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4365655c4219 Credits Lucio Sá Required...

PT-2024-25871 · Unknown · Configure Login Timeout

Name of the Vulnerable Software and Affected Versions: Configure Login Timeout versions from n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: F...

PT-2024-6208 · Unknown +2 · Hdf5 Library +2

Name of the Vulnerable Software and Affected Versions: HDF5 Library versions prior to 1.14.4 Description: The issue is related to the function H5E printf stack in the file H5Eint.c of the HDF5 Library, which is associated with uncontrolled recursion. This can lead to stack consumption. Exploitati...

WordPress Church Admin Plugin <= 4.1.32 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Admin Type Plugin Vulnerable versions = 4.1.32 Fixed in 4.2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34828 Patch priority Low CVSS severity Low 4.3 Developer Andy Moyle PSID 2d0beb058c1b Credits Dhabaleshwar Das Required...