WordPress Essential Addons for Elementor Pro Plugin <= 5.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Pro Type Plugin Vulnerable versions = 5.8.15 Fixed in 5.8.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5612 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e15428c7c929 Credits...

WordPress plugin Essential Addons for Elementor Pro security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Weather Widget Pro Plugin <= 1.1.40 is vulnerable to Cross Site Scripting (XSS)

Software Weather Widget Pro Type Plugin Vulnerable versions = 1.1.40 Fixed in 1.1.41 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35755 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5b92161cd34b Credits LVT-tholv2k Required privilege...

CVE-2024-32752

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access...

CVE-2024-32752 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access...

CVE-2024-32752

The CVE-2024-32752 issue affects Johnson Controls Software House iStar Pro Door Controller and ICU (ICU tool) with firmware prior to 6.6.B. The root cause is Missing Authentication for Critical Functions in the ICU–door controller communications, enabling potential machine-in-the-middle attacks t...

CVE-2024-32752 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access...

CVE-2024-5684 ID Charger Connect & Pro - JWT-Null-Algorithm

An attacker with access to the private network the charger is connected to or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would...

WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Sensei Pro WC Paid Courses versions = 4.23.1.1.23.1...

WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Sensei Pro WC Paid Courses versions = 4.23.1.1.23.1...

WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability

Authenticated Sensitive Data Exposure vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Otter Blocks PRO versions = 2.6.11...

Johnson Controls Software House iStar Door Controller (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS 4 8.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls Inc. Equipment : Software House iStar Pro Door Controller, ICU Vulnerability : Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this...

PT-2024-5077 · Johnson Controls · Istar Pro Door Controller

Name of the Vulnerable Software and Affected Versions: Johnson Controls Software House iStar Pro Door Controller affected versions not specified Description: The issue is related to the lack of authentication for a critical function in the ICU tool and iSTAR Pro door controller, which can be...

Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access

Description The plugin does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database. PoC 1. ADMIN: Install Kadence Blocks Pro 2. CONTRIBUTOR: Add shortcode to any post and specify/guess the option name and save...

Johnson Controls Software House iStar Pro Door Controller Security Vulnerability

Johnson Controls Software House iStar Pro Door Controller is an access control device from Johnson Controls, Inc. A security vulnerability exists in the Johnson Controls Software House iStar Pro Door Controller that stems from vulnerability to man-in-the-middle attacks that could affect door...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WordPress Otter Blocks PRO Plugin <= 2.6.11 is vulnerable to Sensitive Data Exposure

Software Otter Blocks PRO Type Plugin Vulnerable versions = 2.6.11 Fixed in 2.6.12 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-35682 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 106a1e47802a Credits Dave Jong Patchstack...

ID Charger Security Vulnerability

The Volkswagen Group ID Charger is a home all-in-one charger from Volkswagen Group Germany. A security vulnerability exists in ID Charger Connect & Pro, which stems from a misimplementation of the JWT library, and can be exploited by unauthenticated attackers to bypass the authentication mechanis...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Broken Access Control

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5a225c011e38 Credits...

CVE-2024-33568

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3...