PT-2025-6608 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: The WP Project Manager versions up to, and including, 2.6.17 Description: The issue is related to a missing capability check in the "/pm/v2/settings/notice" endpoint, which can lead to unauthorized loss of data. This allows authenticated...

CVE-2024-13752: Missing Authorization

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This mak...

SUSE CVE-2024-40898

SSRF in Apache HTTP Server on Windows with modrewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue...

CVE-2025-1216

A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotel...

CVE-2025-0997

creationtimestamp| type| source ---|---|--- 2025-02-12 19:07:27+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113992482587961618 2025-02-13 08:20:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/113995599655907229 2025-02-15 01:30:42+00:00| seen|...

CVE-2024-13800

The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cpdismissnotice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it possible for authenticated attackers,...

PT-2025-6442

Name of the Vulnerable Software and Affected Versions ConvertPlus plugin for WordPress versions up to, and including, 3.5.30 Description The issue allows unauthorized modification of data, potentially leading to a denial of service. This is due to a missing capability check on the 'cp dismiss...

PT-2025-7456 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR agent affected versions not specified Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to...

yimioa SQL注入漏洞

yimioa Cloudweb OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in yimioa version 2024.07.03 and earlier versions, which originates from the selectNoticeList function of com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml contains a SQL injection...

CVE-2024-12599

creationtimestamp| type| source ---|---|--- 2025-02-11 04:31:42+00:00| seen| https://infosec.exchange/users/cve/statuses/113983376697733169 2025-02-11 05:15:50+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhuvpkjkyr23 2025-02-11 07:18:59+00:00| seen|...

CGA-PXWF-96P5-25JH

Bulletin has no description...

UK Is Ordering Apple to Break Its Own Encryption

The Washington Post is reporting that the UK government has served Apple with a "technical capability notice" as defined by the 2016 Investigatory Powers Act, requiring it to break the Advanced Data Protection encryption in iCloud for the benefit of law enforcement. This is a big deal, and...

CVE-2025-1107

creationtimestamp| type| source ---|---|--- 2025-02-07 14:16:08+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhlrzyquxy2u 2025-02-07 14:48:40+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113963153430960574 2025-02-07 16:19:41+00:00| seen|...

CVE-2025-25075 WordPress Show notice or message on admin area plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through = 2.0...

CVE-2025-25075: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through = 2.0...

CVE-2024-49794

creationtimestamp| type| source ---|---|--- 2025-02-05 23:43:57+00:00| seen| https://infosec.exchange/users/cve/statuses/113953933714417190 2025-02-06 00:16:48+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhhsob276i2f 2025-02-06 02:44:21+00:00| seen|...

CVE-2024-12233

A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may...

Medium: java-17-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13,...

CVE-2024-8277

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login function and not properly verifying the user's identit...

CVE-2025-22675: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through =...