WordPress Magical Addons For Elementor Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.34 Fixed in 1.1.35 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34547 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 74ccb66566e9 Credits Khalid Yusuf Required...

WordPress Shared Files Plugin <= 1.7.19 is vulnerable to Broken Access Control

Software Shared Files Type Plugin Vulnerable versions = 1.7.19 Fixed in 1.7.20 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34438 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID 04ad9b91bcca Credits domiee13 Required privilege...

CVE-2024-34078

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2024-34064

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as...

AZL-40466 CVE-2024-34069 affecting package python-werkzeug for versions less than 2.3.7-2

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

WordPress Hostel Plugin <= 1.1.5.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hostel Type Plugin Vulnerable versions = 1.1.5.3 Fixed in 1.1.5.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4314 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5c8220b39532 Credits Benedictus Jovan aillesiM...

WordPress Startklar Elementor Addons Plugin <= 1.7.13 is vulnerable to Arbitrary File Upload

Software Startklar Elementor Addons Type Plugin Vulnerable versions = 1.7.13 Fixed in 1.7.14 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-4345 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 644cf683da36 Credits István Márton Required...

WordPress raindrops Theme <= 1.600 is vulnerable to Cross Site Scripting (XSS)

Software raindrops Type Theme Vulnerable versions = 1.600 Fixed in 1.700 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34414 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d4e3ff80bd8c Credits stealthcopter Required privilege Contributor...

WordPress SliceWP Plugin <=1.1.10 is vulnerable to Cross Site Scripting (XSS)

Software SliceWP Type Plugin Vulnerable versions =1.1.10 Fixed in 1.1.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34413 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c46a4aefe49b Credits Manab Jyoti Dowarah Required privilege...

WordPress Testimonial Slider Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Testimonial Slider Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4193 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9c9e113bbfe1 Credits Krzysztof Zając...

WordPress Stop Spammers Plugin <= 2024.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Stop Spammers Type Plugin Vulnerable versions = 2024.4 Fixed in 2024.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7065 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 314cb001df78 Credits Lucio Sá Required...

CVE-2024-34068 Server-side Request Forgery during remote file pull in Pterodactyl wings

Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. Thi...

CVE-2024-34145

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin within the sandbox-defined classes, enabling the circumvention of security restrictions. This flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protecti...

CVE-2023-47220

The CVE-2023-47220 issue affects the Media Streaming add-on prior to version 500.1.1.5. It describes an OS command injection vulnerability that could allow an authenticated administrator to execute commands over the network. The fixed release is Media Streaming add-on 500.1.1.5 (2024-01-22) and l...

PT-2024-25909 · Buildroot · Buildroot

Name of the Vulnerable Software and Affected Versions: Buildroot versions prior to 0b2967e Buildroot version 2024.02.2 and later are not affected, but all versions before 0b2967e are vulnerable. Since 2024.02.2 is the fixed version, we list all versions prior to 0b2967e as vulnerable. Description...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Broken Access Control

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6327 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b04aa8b3961f Credits Francesco Carlucci Required privile...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3991 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b56a67a53737 Credits stealthcopter Required...

WordPress Elementor Pro Plugin <= 3.21.0 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Pro Type Plugin Vulnerable versions = 3.21.0 Fixed in 3.21.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4107 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5e068ca3d9a8 Credits wesley wcraft Required...

WordPress Sheets To WP Table Live Sync Plugin <= 3.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Sheets To WP Table Live Sync Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34375 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 592f4fe7fc70 Credits Manab Jyoti Dowarah...

WordPress Mooberry Book Manager Plugin <= 4.15.12 is vulnerable to Sensitive Data Exposure

Software Mooberry Book Manager Type Plugin Vulnerable versions = 4.15.12 Fixed in 4.15.13 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-34368 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8048e91588cf Credits Steven Julian...