WordPress WooCommerce Box Office Plugin <= 1.2.2 is vulnerable to Broken Access Control

Software WooCommerce Box Office Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24799 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2e62ee904d23 Credits Rafie Muhammad...

WordPress Fatal Error Notify Plugin < 1.5.3 is vulnerable to Broken Access Control

Software Fatal Error Notify Type Plugin Vulnerable versions 1.5.3 Fixed in 1.5.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7202 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55ba4f7fb253 Credits Dmitrii Ignatyev Required...

WordPress PropertyHive Plugin <= 2.0.6 is vulnerable to Broken Access Control

Software PropertyHive Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24718 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4eea0b5c54d4 Credits Yudistira Arya Required privileg...

WordPress Shareaholic Plugin <= 9.7.11 is vulnerable to Broken Access Control

Software Shareaholic Type Plugin Vulnerable versions = 9.7.11 Fixed in 9.7.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24709 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID e941ba723f22 Credits Abdi Pranata Required...

WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Chartify Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47526 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b1cfc37aafc1 Credits Jeongwoo-LeeRoronoa Required privilege...

WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection

Software ERE Recently Viewed Type Plugin Vulnerable versions = 1.3 Fixed in 2.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24797 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 835850fa9817 Credits Yudistira Arya Required privilege...

WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Debug Type Plugin Vulnerable versions = 1.10 Fixed in 1.11 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24798 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7c7ee723dce1 Credits Nguyen Xuan Chien Required...

WordPress Ultra Companion Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Ultra Companion Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24803 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 27efb6397cad Credits Ray Wilson Required privilege...

GHSA-J6VV-VV26-RH7C HashiCorp Vault Improper Privilege Management

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4...

Design/Logic Flaw

TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That user input is filtered insufficiently, which makes it is possible to send requests to unintended network locations and receive responses. On...

Code injection

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...

WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Email Before Download Type Plugin Vulnerable versions = 6.9.7 Fixed in 6.9.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-23519 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0219cc769beb Credits Mika Required...

WordPress ACF Photo Gallery Field Plugin <= 2.6 is vulnerable to Broken Access Control

Software ACF Photo Gallery Field Type Plugin Vulnerable versions = 2.6 Fixed in 2.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-23518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 90b02382eae5 Credits Abdi Pranata Required...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress Formidable Forms Plugin <= 6.7.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Formidable Forms Type Plugin Vulnerable versions = 6.7.2 Fixed in 6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0660 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7a7ac0638cbc Credits Webbernaut Required...

WordPress Simple Shopping Cart Plugin <= 4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Simple Shopping Cart Type Plugin Vulnerable versions = 4.7.1 Fixed in 4.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6497 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b281d4b588f2 Credits Webbernaut Required...

WordPress Instant Images Plugin <= 6.1.0 is vulnerable to Broken Access Control

Software Instant Images Type Plugin Vulnerable versions = 6.1.0 Fixed in 6.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0869 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 5f84c56450a0 Credits Sean Murphy Required...

CVE-2023-52389

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert and Poco::UTF32::queryConvert may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in...

CloudLinux CageFS 7.1.1-1 Token Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CloudLinux CageFS Token Disclosure Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01CloudLinuxCageFSTokenDisclosure Vulnerability Overview CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a...

Security Bulletin: Protobuf as used by IBM QRadar SIEM is vulnerable to denial of service (CVE-2022-3171, CVE-2022-3509)

Summary Protobuf as used by IBM QRadar SIEM is vulnerable to denial of service. IBM QRadar SIEM has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2022-3171 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing...