Ubuntu: Security Advisory (USN-6871-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-79W7-VH3H-8G4J yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...

Debian: Security Advisory (DLA-3843-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-22232

CVE-2024-22232 describes a directory traversal in Salt’s file server triggered by a specially crafted URL. The underlying issue is input validation that allows traversal sequences, enabling a malicious user to read arbitrary files from a Salt master’s filesystem. Affected component: Salt master/f...

CVE-2024-22231

CVE-2024-22231 affects Salt: Syndic cache directory creation is vulnerable to directory traversal during cache dir creation on the Salt master, enabling an attacker to create arbitrary directories. Reported across multiple advisories (Gentoo GLSA 202412-09; SUSE-SU-2024:1518-1; Debian/Ubuntu/NVD ...

Exploit for SQL Injection in Opencart

CVE-2024-21514 PoC and Bulk Scanner !Bannerscreens/screen...

Exploit for Code Injection in Xwiki

CVE-2024-31982 PoC and Bulk Scanner !Bannerscreens/scree...

CVE-2023-38389

CVE-2023-38389 affects JupiterX Core (WordPress plugin) and is a Privilege Escalation via Incorrect Authorization in versions up to and including 3.3.8. The root cause is improper access control that allows unauthenticated users to access restricted functionality, enabling an account takeover sce...

CVE-2023-39312

CVE-2023-39312 reports a Missing Authorization vulnerability in ThemeFusion Avada affecting versions up to 7.11.1. The issue arises from an authenticated (Author+) Arbitrary File Upload via zip extraction vulnerability in Avada, enabling a user with author-level privileges to upload files through...

CVE-2023-38386

CVE-2023-38386 affects the WordPress Ninja Forms plugin, specifically versions up to 3.6.25, due to a Missing Authorization/Broken Access Control issue in the form submissions export feature. Root cause involves insufficient access restrictions allowing certain users to export submissions. The CV...

CVE-2023-35049

CVE-2023-35049 affects the WordPress WooCommerce Stripe Payment Gateway plugin

CVE-2023-41805

CVE-2023-41805 is a Missing Authorization (Broken Access Control) issue in Brainstorm Force Premium Starter Templates and Brainstorm Force Starter Templates astra-sites, affecting Premium Starter/Templates ≤ 3.2.5. Root cause: insufficient authorization checks enabling access to data/configs. Pat...

CVE-2023-39993

CVE-2023-39993 refers to a Broken Access Control issue in the WordPress plugin ElementsKit Lite / Elementor addons . Affected versions are ≤ 2.9.0 (Wpmet ElementsKit Lite). The root cause is a Missing Authorization/Access control weakness that could allow unauthorized actions. Remediation: upgrad...

CVE-2023-40004

CVE-2023-40004 is a Missing Authorization vulnerability affecting multiple ServMask WordPress extensions (Box, OneDrive, Dropbox, Google Drive) for All-in-One WP Migration. Connected sources (Patchstack) confirm unauthenticated access token manipulation due to insufficient authorization in the pl...

CVE-2023-44148

CVE-2023-44148 affects the WordPress Astra Bulk Edit plugin (

CVE-2023-44151

The CVE-2023-44151 entry corresponds to a Broken Access Control vulnerability in the WordPress Pre-Publish Checklist plugin (versions ≤ 1.1.1). The root cause is missing authorization/authentication validation, enabling access control bypass related to the Pre-Publish Checklist feature. Affected ...

CVE-2023-45658

The CVE concerns the WordPress Nexter theme (

CVE-2023-46146

CVE-2023-46146 relates to Themify Themify Ultra (Theme) with versions up to 7.3.5, where a Missing Authorization/Broken Access Control vulnerability could allow unauthorized access. Public sources indicate the issue affects Themify Ultra through 7.3.5 and that Patchstack lists the fixed version a...

CVE-2023-46148

CVE-2023-46148 – Themify Ultra (WordPress Theme) \n\nTechnical details from the provided sources indicate a Missing Authorization vulnerability in Themify Ultra (affecting versions up to 7.3.5). The root cause is insufficient access control that allows an authenticated user with subscriber-level ...

CVE-2023-47770

CVE-2023-47770 concerns Betheme WordPress theme (Muffin Group) with a Missing Authorization vulnerability in versions up to 27.1.1. The issue is described as Broken Access Control / Missing Authorization, enabling privilege escalation for authenticated users (Contributor level and above) to acces...