7746 matches found
CVE-2024-0593 Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure
The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetchquickjob function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can b...
CVE-2024-0593
The CVE pertains to the WordPress plugin Simple Job Board . It reports insufficient authorization checks in the function fetch_quick_job() affecting all versions up to and including 2.10.8 , allowing unauthenticated attackers to fetch arbitrary (potentially password‑protected or private) posts co...
WordPress Plugin Simple Job Board Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress Simple Job Board Plugin <= 2.10.8 is vulnerable to Broken Access Control
Software Simple Job Board Type Plugin Vulnerable versions = 2.10.8 Fixed in 2.11.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0593 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 752406ce2200 Credits Krzysztof Zając Required...
CVE-2023-6806 Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings
The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
PT-2024-15674
Name of the Vulnerable Software and Affected Versions The Simple Job Board plugin for WordPress versions up to, and including, 2.10.8 Description The issue allows unauthorized access to data due to insufficient authorization checking on the fetch quick job function. This makes it possible for...
RustDoor macOS Backdoor Targets Cryptocurrency Firms with Fake Job Offers
Several companies operating in the cryptocurrency sector are the target of a newly discovered Apple macOS backdoor codenamed RustDoor. RustDoor was first documented by Bitdefender last week, describing it as a Rust-based malware capable of harvesting and uploading files, as well as gathering...
CVE-2023-40112
In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2024-12850 · Cups · Cups
Name of the Vulnerable Software and Affected Versions: CUPS affected versions not specified Description: The issue is related to a missing bounds check in the ippSetValueTag function of ipp.c, which could lead to a possible out of bounds read. This might result in local information disclosure of...
jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...
jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...
jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials
A flaw was found in the blueocean Jenkins plugin. Affected versions of this plugin allow attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job...
jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...
jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...
Server-Side Request Forgery (SSRF)
xxl-job is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is caused due to improper validation of user-supplied input within JobInfoController.java. This allows an attacker to supply a malicious address, potentially leading to Server-Side Request Forgery SSRF...
Starbox < 3.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings
Description The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
XXL-JOB vulnerable to Server-Side Request Forgery
xxl-job = 2.4.2 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...
GHSA-C352-X843-GGPQ XXL-JOB vulnerable to Server-Side Request Forgery
xxl-job = 2.4.2 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...
