CVE-2024-21647 HTTP Request/Response Smuggling in puma

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an...

WordPress Revolut Gateway for WooCommerce Plugin <= 4.9.7 is vulnerable to Broken Access Control

Software Revolut Gateway for WooCommerce Type Plugin Vulnerable versions = 4.9.7 Fixed in 4.9.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52224 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 56db209d55d0 Credits Abdi Pranata...

WordPress Profile Builder Plugin <= 3.10.7 is vulnerable to Insecure Direct Object References (IDOR)

Software Profile Builder Type Plugin Vulnerable versions = 3.10.7 Fixed in 3.10.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6504 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4a72357868f4 Credits Francesco...

WordPress Oxygen Builder Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.8 Fixed in 4.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6938 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5b6e074aaeac Credits Francesco Carlucci Required...

PT-2024-18994

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev77 Description Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET KEY variable. This issue allows attackers to access sensitive information, which could ha...

WordPress WPvivid Backup and Migration Plugin <= 0.9.68 is vulnerable to Broken Access Control

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.68 Fixed in 0.9.69 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1982 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79947c67cdef Credits Denis Werner...

CVE-2023-41289

An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QcalAgent 1.1.8 and later...

Input validation

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-41287 Video Station

A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

CVE-2023-47219 QuMagie

A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later...

WordPress WP Job Manager Plugin <= 2.0.0 is vulnerable to Broken Access Control

Software WP Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52211 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dca091e30b7d Credits Rafie Muhammad Patchstack...

WordPress Quiz Maker Plugin <= 6.5.1.1 is vulnerable to Broken Access Control

Software Quiz Maker Type Plugin Vulnerable versions = 6.5.1.1 Fixed in 6.5.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-21743 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a1ecb2fb052d Credits Abdi Pranata Required...

WordPress Booster Plus for WooCommerce Plugin < 7.1.3 is vulnerable to Sensitive Data Exposure

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52230 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 715c035601b4 Credits Dave Jong...

WordPress Depicter Slider Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Depicter Slider Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6493 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15e2f683e7f4 Credits Rafshanzani Suhada...

WordPress My Sticky Bar Plugin <= 2.6.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software My Sticky Bar Type Plugin Vulnerable versions = 2.6.6 Fixed in 2.6.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7048 Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID 50c4e2183073 Credits Ulyses Saicha Required...

WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.23 Fixed in 1.5.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52193 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 70cd66e65bfa Credits Ngô Thiên An ancorn from...

PT-2024-2692 · Siemens · Tecnomatix Plant Simulation

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation V2201 All versions Tecnomatix Plant Simulation V2302 versions prior to V2302.0007 Description: A null pointer dereference vulnerability has been identified in the affected applications while parsing specially craft...

WordPress FooGallery Premium Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software FooGallery Premium Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6747 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6e234ed1eb7c Credits WordFence Required...

WordPress Post SMTP Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7027 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID 7142ca21bf69 Credits Sean Murphy Required privilege...

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.15.2 is vulnerable to Cross Site Scripting (XSS)

Software 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Type Plugin Vulnerable versions = 1.15.2 Fixed in 1.15.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6776 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...