WordPress Calendarista Basic Edition Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Calendarista Basic Edition Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27993 Patch priority Medium CVSS severity Medium 7.1 Developer Typps PSID fee56b010abe Credits Mochamad Sofyan Required...

WordPress Contact Form by BestWebSoft Plugin <= 4.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form by BestWebSoft Type Plugin Vulnerable versions = 4.2.8 Fixed in 4.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2198 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b02a52616ddf Credits...

WordPress Link Library Plugin <= 7.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Link Library Type Plugin Vulnerable versions = 7.6.6 Fixed in 7.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2325 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ac3bb374efb Credits Krzysztof Zając...

WordPress Crisp Plugin <= 0.44 is vulnerable to Cross Site Scripting (XSS)

Software Crisp Type Plugin Vulnerable versions = 0.44 Fixed in 0.45 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27963 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d24f23d72736 Credits stealthcopter Required privilege Subscriber...

WordPress Contact Form 7 Plugin <= 5.9 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Type Plugin Vulnerable versions = 5.9 Fixed in 5.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2242 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d34f7907f9a Credits Asaf Mozes Required...

WordPress Zippy Plugin <= 1.6.9 is vulnerable to Arbitrary File Upload

Software Zippy Type Plugin Vulnerable versions = 1.6.9 Fixed in 1.6.10 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2024-27964 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID f32b93d01376 Credits stealthcopter Required...

WordPress wp-mpdf Plugin <= 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software wp-mpdf Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27962 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 94c383c2d70a Credits stealthcopter Required privilege...

WordPress WP Fusion Lite Plugin <= 3.41.24 is vulnerable to Remote Code Execution (RCE)

Software WP Fusion Lite Type Plugin Vulnerable versions = 3.41.24 Fixed in 3.42.10 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-27972 Patch priority Medium CVSS severity Medium 9.9 Developer Very Good Plugins PSID 814e5262b633 Credits LVT-tholv2k Required...

WordPress Advanced Sermons Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.2 Fixed in 3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27952 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b2bcdc917d74 Credits Le Ngoc Anh Required privilege...

Fingerprint Reader Vulnerabilities - Lenovo Support US

No description provided...

NetApp SnapCenter Improper Authorization Vulnerability - Lenovo Support US

No description provided...

Advisory ROSA-SA-2024-2371

software: firefox 118.0.2 OS: ROSA-CHROME packageevrstring: firefox-118.0.2-1.src.rpm CVE-ID: CVE-2011-0064 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: The hbbufferensure function in hb-buffer.c in HarfBuzz, used in Pango, Firefox, and other products, does not check for successful memory reallocatio...

WordPress WP Statistics Plugin <= 14.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Statistics Type Plugin Vulnerable versions = 14.5 Fixed in 14.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2194 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef2615a6c0c9 Credits Tim Coen Required...

WordPress Newsletter2Go Plugin <= 4.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter2Go Type Plugin Vulnerable versions = 4.0.13 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1328 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1277fbb17528 Credits Francesco Carlucci...

WordPress Formidable Registration Plugin < 2.12 is vulnerable to Broken Authentication

Software Formidable Registration Type Plugin Vulnerable versions 2.12 Fixed in 2.12 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-1290 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID de229a590aad Credits Scott Kingsley Clark...

WordPress Bulgarisation for WooCommerce Plugin <= 3.0.14 is vulnerable to Broken Access Control

Software Bulgarisation for WooCommerce Type Plugin Vulnerable versions = 3.0.14 Fixed in 3.0.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0683 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9bca55e3b9c3 Credits Francesc...

WordPress EventPrime Plugin <= 3.4.3 is vulnerable to Broken Access Control

Software EventPrime Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.4.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1124 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5630665ed0a8 Credits Lucio Sá Required privilege...

TA4903 Spoofing Government Entities and SMBs for Financial Gain

Summary: TA4903, a financially motivated threat actor, conducts high-volume email campaigns targeting U.S. organizations for credential phishing and business email compromise BEC. They spoof various U.S. government agencies and private businesses, employing tools like EvilProxy and incorporating ...

WordPress affiliate-toolkit Plugin <= 3.5.4 is vulnerable to Broken Access Control

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1851 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 2242c759db29 Credits Lucio Sá Required...

WordPress Ultimate Member Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2123 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4d51add86a5f Credits stealthcopter...