SUSE-SU-2024:1989-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: - Bump github.com/containers/image/v5 bsc1224119,...

SUSE-SU-2024:1988-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Rebuild against current updated packages and go...

CVE-2024-35754

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3...

CVE-2024-35754

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3...

CVE-2024-35754 WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3...

CVE-2024-35754 WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3...

WordPress plugin Ovic Importer path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2023-6876

The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated...

CVE-2023-6876

CVE-2023-6876 (Clever Fox – One Click Website Importer) is an authenticated-actor vulnerability in the Clever Fox WordPress plugin where a missing capability check on clever-fox-activate-theme allows users with subscriber+ privileges to modify the active theme (incl. to an invalid value) in versi...

WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Ovic Importer versions = 1.6.3...

WordPress Ovic Importer Plugin <= 1.6.3 is vulnerable to Arbitrary File Download

Software Ovic Importer Type Plugin Vulnerable versions = 1.6.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-35754 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID cc9fdc38f203 Credits Majed Refaea Required privile...

PT-2024-15112 · Nayra Themes · The Clever Fox – One Click Website Importer

Name of the Vulnerable Software and Affected Versions: The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress versions up to, and including, 25.2.0 Description: The issue is related to a missing capability check on the clever-fox-activate-theme function, allowing...

WordPress Gutenberg & Elementor Templates Importer For Responsive Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg & Elementor Templates Importer For Responsive Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5222 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

DRUPAL-CONTRIB-2024-024

The Migrate queue importer module enables you to create cron migrationsconfiguration entities with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an...

Drupal Migrate queue importer module < 2.1.1 - Administrator+ Cross Site Request Forgery (CSRF) vulnerability

Administrator+ Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff in WordPress Module Migrate queue importer versions 2.1.1...

PT-2024-10357 · Drupal · Migrate Queue Importer

Name of the Vulnerable Software and Affected Versions: Migrate queue importer versions 0.0.0 through 2.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Migrate queue importer module of the Drupal content management system. This vulnerability allows f...

Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

The Migrate queue importer module enables you to create cron migrationsconfiguration entities with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an...

AZL-42319 CVE-2024-3727 affecting package containerized-data-importer for versions less than 1.55.0-19

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

AZL-42318 CVE-2024-3727 affecting package containerized-data-importer for versions less than 1.57.0-2

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

CVE-2024-32724

Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1...