WordPress Countdown & Clock Plugin <= 2.7.8 is vulnerable to PHP Object Injection

Software Countdown & Clock Type Plugin Vulnerable versions = 2.7.8 Fixed in 2.7.8.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-2017 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID e293306cdd98 Credits Lucio Sá Required privilege...

Ruby < 3.0.7 / 3.1.x < 3.1.5 / 3.2.x < 3.2.4 / 3.3.x < 3.3.1 RCE

The version of Ruby installed on the remote host is prior to 3.0.7, 3.1.5, 3.2.4, or 3.3.1. It is, therefore, affected by a vulnerability as referenced in the rce-rdoc-cve-2024-27281 advisory. - An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When...

Countdown, Coming Soon, Maintenance – Countdown & Clock < 2.7.8.1 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection

Description The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for...

PT-2024-18629 · WordPress · Countdown

Name of the Vulnerable Software and Affected Versions: The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress versions up to, and including, 2.7.8 Description: The issue is related to a missing capability check on the conditionsRow and switchCountdown functions, allowing...

CVE-2024-33568

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...

CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...

CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...

ruby: RCE vulnerability with .rdoc_options in RDoc

A flaw was found in Rubygem RDoc. When parsing .rdocoptions used for configuration in RDoc as a YAML file there are no restrictions on the classes that can be restored. This issue may lead to object injection, resulting in remote code execution...

Deserialization Of Untrusted Data

symbiote/silverstripe-multivaluefield is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to inadequate validation of user input, as well as object injection caused by support for handling PHP objects as values, which allows an attacker to inject malicious scripts...

symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension

A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection. Support for handling PHP objects as values in this module has been deprecated, and the...

GHSA-G5VJ-WJ9X-4JG9 symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension

A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection. Support for handling PHP objects as values in this module has been deprecated, and the...

PT-2024-40290 · Symbiote · Silverstripe-Multivaluefield

Name of the Vulnerable Software and Affected Versions: symbiote/silverstripe-multivaluefield affected versions not specified Description: A potential deserialisation issue has been identified, which could allow an attacker to exploit implementations of this module via object injection...

WordPress Hash Form – Drag & Drop Form Builder plugin <= 1.1.0 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Hash Form versions = 1.1.0...

WordPress 140+ Widgets | Best Addons For Elementor – FREE plugin <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Xpro Elementor Addons versions = 1.4.3.1...

WordPress Hash Form Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Hash Form Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5085 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 96e7546828a2 Credits Francesco Carlucci Required privilege...

WordPress Xpro Elementor Addons Plugin <= 1.4.3.1 is vulnerable to PHP Object Injection

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.3.1 Fixed in 1.4.3.2 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4471 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID db21342544db Credits Francesco Carlucci Required privile...

CVE-2024-5085

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'processentry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No...

CVE-2024-5085

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'processentry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No...

CVE-2024-5085

CVE-2024-5085 affects the Hash Form – Drag & Drop Form Builder for WordPress. The vulnerability is a PHP Object Injection via deserialization of untrusted input in the process_entry function across all versions up to and including 1.1.0. This enables unauthenticated attackers to inject a PHP obje...

CVE-2024-5085 Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'processentry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No...