CVE-2024-47318

CVE-2024-47318 refers to a Missing Authorization/Broken Access Control vulnerability in the PWA for WP & AMP WordPress plugin (versions up to 1.7.72). The issue arises from misconfigured access control, allowing bypass of authorization checks. Patch information from Patchstack indicates the fix i...

CVE-2024-8967

The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8967

The CVE refers to the WordPress plugin “PWA — easy way to Progressive Web App” (iworks-pwa) with Stored Cross-Site Scripting via SVG file uploads in versions up to 1.6.3. Root cause: insufficient input sanitization and output escaping for uploaded SVGs, enabling authenticated attackers (Author le...

CVE-2024-8967 PWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress PWA plugin <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin PWA versions = 1.6.3...

WordPress PWA Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

Software PWA Type Plugin Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8967 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c235cb7639b9 Credits Francesco Carlucci Required privileg...

WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin PWA for WP & AMP versions = 1.7.72...

WordPress PWA for WP & AMP Plugin <= 1.7.72 is vulnerable to Broken Access Control

Software PWA for WP & AMP Type Plugin Vulnerable versions = 1.7.72 Fixed in 1.7.73 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47318 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d773a07c2444 Credits Trương Hữu Phúc...

Czech Mobile Users Targeted in New Banking Credential Theft Scheme

Mobile users in the Czech Republic are the target of a novel phishing campaign that leverages a Progressive Web Application PWA in an attempt to sidestep security protections and steal their banking account credentials. The attacks have targeted the Czech-based Československá obchodní banka CSOB,...

Malicious code in trips-pwa-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2711cf5153838983e0237668dc1baaa1ad85959278de51e6e06702482099b582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7997 Malicious code in trips-pwa-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2711cf5153838983e0237668dc1baaa1ad85959278de51e6e06702482099b582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Minor update(3) for Vivaldi Android Browser 6.7

Head to the Google Play Store and download the browser. Alternatively, you can download Vivaldi from Uptodown, the Android app store. Your rating for our browser matters. ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ Enjoy! Changelog The following is a list of changes since the second 6.7 stable, minor update: Sync Avoid...

Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization

Description The Progressive WordPress PWA plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform ...

CVE-2024-33937

Missing Authorization vulnerability in Nico Martin Progressive WordPress PWA.This issue affects Progressive WordPress PWA: from n/a through 2.1.13...

CVE-2024-33937 WordPress Progressive WordPress (PWA) plugin <= 2.1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nico Martin Progressive WordPress PWA.This issue affects Progressive WordPress PWA: from n/a through 2.1.13...

CVE-2024-33937 WordPress Progressive WordPress (PWA) plugin <= 2.1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nico Martin Progressive WordPress PWA.This issue affects Progressive WordPress PWA: from n/a through 2.1.13...

Malicious code in discount-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b62bcefcaea2db2548388a227a4b29129aec31ac8138d04b9763fbd8e5bb54ac Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-260 Malicious code in discount-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b62bcefcaea2db2548388a227a4b29129aec31ac8138d04b9763fbd8e5bb54ac Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

CVE-2021-4366

The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwpupdatefeaturesoptions function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings...

CVE-2021-4354

The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...