178 matches found
WordPress Debug Log Manager Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)
Software Debug Log Manager Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-32582 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1f92fe55cb9f Credits Majed Refaea Required...
WordPress SEO Booster Plugin <= 3.8.9 is vulnerable to Cross Site Request Forgery (CSRF)
Software SEO Booster Type Plugin Vulnerable versions = 3.8.9 Fixed in 3.8.10 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-32438 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3512a5ab10e4 Credits Joshua Chan Required privile...
WordPress Smash Balloon Social Post Feed Plugin <= 4.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Smash Balloon Social Post Feed Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31379 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0081dd599b5c Credits Majed Refa...
WordPress WP Event Aggregator Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF)
Software WP Event Aggregator Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31371 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c79f1a6daa54 Credits Majed Refaea Required...
CVE-2024-3165
System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...
CVE-2024-3165
CVE-2024-3165 affects dotCMS where the System->Maintenance-> Log Files output reveals database credentials (username/password) in logs. This is described as a moderate issue requiring backend admin access and environment-led DB lockdown. Connected documents confirm the vulnerability stems f...
CVE-2024-3165 Database Credential Exposure in the Logs
System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...
CVE-2024-3165 Database Credential Exposure in the Logs
System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...
CVE-2024-3165 Database Credential Exposure in the Logs
System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...
CVE-2024-3164
The CVE-2024-3164 issue affects dotCMS where the Tools and Log Files tabs under System → Maintenance Portlet are accessible to any user with the portlet, not just CMS Admins. The vulnerability arises from broken access control, allowing site-admin users (without system-admin privileges) to access...
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...
PT-2024-24175 · Dotcms · Dotcms
Name of the Vulnerable Software and Affected Versions: dotCMS affected versions not specified Description: The issue is related to the System-Maintenance- Log Files in the dotCMS dashboard, which is providing the username/password for database connections in the log output. This is considered a...
WordPress WP Express Checkout (Accept PayPal Payments) Plugin <= 2.3.7 is vulnerable to Other Vulnerability Type
Software WP Express Checkout Accept PayPal Payments Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A4: Insecure Design Classification Other Vulnerability Type CVE CVE-2024-30527 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e7e1b499917d Credits Xinzh...
WordPress GamiPress Plugin <= 6.8.5 is vulnerable to Cross Site Request Forgery (CSRF)
Software GamiPress Type Plugin Vulnerable versions = 6.8.5 Fixed in 6.8.6 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30455 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7284ec56cbcf Credits Ananda Dhakal Patchstack Requir...
WordPress Salon booking system Plugin <= 9.5 is vulnerable to Arbitrary File Upload
Software Salon booking system Type Plugin Vulnerable versions = 9.5 Fixed in 9.5.1 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2024-30510 Patch priority Medium CVSS severity Medium 10 Developer Claim ownership PSID 17f873db702b Credits stealthcopter Required...
WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Request Forgery (CSRF)
Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30460 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c704327afb62 Credits Majed Refaea...
WordPress RegistrationMagic Plugin <= 5.3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software RegistrationMagic Type Plugin Vulnerable versions = 5.3.0.0 Fixed in 5.3.1.0 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-2951 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1d9399326561 Credits Joshua Chan Required...
WordPress Formidable Registration Plugin < 2.12 is vulnerable to Broken Authentication
Software Formidable Registration Type Plugin Vulnerable versions 2.12 Fixed in 2.12 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-1290 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID de229a590aad Credits Scott Kingsley Clark...
WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Bypass Vulnerability
Software Page Restrict Type Plugin Vulnerable versions = 2.5.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0682 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e5dc30bc662f Credits Francesco Carlucci Required privilege...