CVE-2024-45440

Summary: CVE-2024-45440 affects Drupal 11.x-dev, where core/authorize.php can disclose full file paths when hash_salt is set to file_get_contents of a non-existent file. Affected components: Drupal 11.x-dev, core/authorize.php. Root cause (as stated): hash_salt evaluated via file_get_contents of ...

WordPress plugin GiveWP has a vulnerability related to information leakage.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

PT-2024-37708 · WordPress +1 · Givewp +1

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions up to, and including, 3.15.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin utilizes Symfony and leaves display errors...

CVE-2024-45440: Generation of Error Message Containing Sensitive Information

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal version 11.x-dev, which stems from a full-path disclosure issue in the core/authorize.php file, resulting in full-path information being disclosed...

CVE-2024-45440

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...

CVE-2024-6551: Exposure of Sensitive Information to an Unauthorized Actor

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving displayerrors on within test files. This makes it possible for unauthenticated...

CVE-2024-6448 Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure

The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full...

CVE-2024-6448 Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure

The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full...

WordPress Mollie Payments for WooCommerce plugin <= 7.7.0 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Mollie Payments for WooCommerce versions = 7.7.0...

PT-2024-6543 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions 11.x-dev Description: The issue is related to a Full Path Disclosure flaw in the core/authorize.php file of the Drupal CMS system. This flaw allows an attacker to disclose system data without authorization. The vulnerability c...

WordPress Mollie Payments for WooCommerce Plugin <= 7.7.0 is vulnerable to Full Path Disclosure (FPD)

Software Mollie Payments for WooCommerce Type Plugin Vulnerable versions = 7.7.0 Fixed in 7.8.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-6448 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 442e1f30b6d2 Credits...

CVE-2024-6448: Exposure of Sensitive Information to an Unauthorized Actor

The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full...

WordPress WordPress Button Plugin MaxButtons plugin <= 9.7.8 - Full Path Disclosure vulnerability

Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin MaxButtons versions = 9.7.8...

CVE-2024-6499 WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other...

CVE-2024-6568

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

CVE-2024-6568 Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

CVE-2024-6568

CVE-2024-6568 affects Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress (versions ≤ 3.1.0). It exposes Full Path Disclosure due to mobiledetect access not being restricted, enabling unauthenticated retrieval of the web root path. This is a low- to medium-severity issue (CVSS v...

CVE-2024-6568 Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

WordPress plugin Flamix has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...