WordPress AI Assistant with ChatGPT by AYS plugin <= 2.0.9 - Unauthenticated AJAX Calls vulnerability

Unauthenticated AJAX Calls vulnerability discovered by Kieran Burge in WordPress Plugin AI ChatBot with ChatGPT and Content Generator by AYS versions = 2.0.9...

CLSA-2024-1727374287 python3.9: Fix of CVE-2024-4032

CVE-2024-4032: fix missing and incorrect ip address ranges in privatenetwork variables...

PT-2024-32335 · Mattermost +1 · Mattermost +1

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.0 Mattermost versions 9.5.x through 9.5.8 Description: The issue arises from the failure to validate that the message of a permalink post is a string, allowing an attacker to send a non-string value as...

PT-2024-32434 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.8 Description: The issue allows an attacker to view posts and files of archived channels via file links when viewing archived channels is disabled, due to a failure to properly authorize access to archive...

PT-2024-39486 · Unknown · Enpass Password Manager

Name of the Vulnerable Software and Affected Versions: Enpass Password Manager versions up to 6.9.5 Description: A vulnerability has been found in Enpass Password Manager, which affects some unknown processing and leads to cleartext storage of sensitive information in memory. The manipulation...

CVE-2024-6590

The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to...

CVE-2024-8941

Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nmeditphpedit.php in the “subpage” parameter, which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a...

Scriptcase 路径遍历漏洞

Scriptcase is a low-code platform for rapid application development from Scriptcase, Inc. A path traversal vulnerability exists in Scriptcase version 9.4.019 that stems from improper parameter handling and allows an unauthenticated remote user to bypass SecurityManager's expected restrictions and...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE 安全漏洞

The Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE DFS ProGauge MAGLINK LX CONSOLE is an industrial console from Dover Fueling Solutions, USA, designed for expansion. A security vulnerability exists in Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE version 4.17.9e and prior versions,...

WordPress plugin ShopLentor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin... A cross-site scripting...

USN-7032-1 tomcat8, tomcat9 vulnerability

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.1 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin WPDM – Premium Packages versions = 5.9.1...

PT-2024-38322 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 through 9.3.3 Concrete CMS versions below 8.5.19 Description: The issue is related to stored XSS in the calendar event addition feature. This occurs because the calendar event name was not sanitized on output. Users or...

Entrust Instant Financial Issuance 安全漏洞

Entrust Instant Financial Issuance Entrust Cardwizard is an instant financial card issuance solution from US-based Entrust Corporation. A security vulnerability exists in Entrust Instant Financial Issuance that stems from an encrypted password that is easily cracked. An attacker could exploit the...

PT-2024-39232 · WordPress · Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: The Quiz and Survey Master QSM WordPress plugin versions prior to 9.1.3 Description: The issue is related to the Quiz and Survey Master QSM WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow...

USN-6968-2 postgresql-9.5 vulnerability

USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and PostgreSQL-16 This update provides the corresponding updates for PostgreSQL-9.5 in Ubuntu 16.04 LTS. Original advisory details: Noah Misch discovered that PostgreSQL incorrectly handled certain SQL objects. An attacker could...

WordPress MC4WP plugin 4.9.9-4.9.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by kauenavarro in WordPress Plugin MC4WP versions 4.9.9-4.9.16...

VulnCheck KEV: CVE-2017-9506

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...

Dragonfly 安全漏洞

Dragonfly is a framework that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly prior to version 2.0.9 that stems from Dragonfly's use of hard-coded JWT to authenticate users, which could lead to authentication bypass...

CVE-2024-43992

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: from n/a through 4.9.91...