CVE-2024-6536

The CVE-2024-6536 entry concerns the Zephyr Project Manager WordPress plugin (versions before 3.3.99). The root cause is insufficient sanitisation/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., Editors/Admins) even when unfiltered_html is disabled, includi...

WordPress plugin Zephyr Project Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Zephyr Project Manager Plugin < 3.3.99 is vulnerable to Cross Site Scripting (XSS)

Software Zephyr Project Manager Type Plugin Vulnerable versions 3.3.99 Fixed in 3.3.99 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6536 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7446412b149f Credits Adrian Peña...

WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability

Sensitive Data Exposure via Export File vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Zephyr Project Manager versions = 3.3.99...

WordPress Zephyr Project Manager Plugin <= 3.3.99 is vulnerable to Sensitive Data Exposure

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.99 Fixed in 3.3.100 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-38761 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 36e0747c0acc Credits Joshua Chan...

CVE-2024-37484

Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97...

CVE-2024-37484

Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97...

CVE-2024-37484

CVE-2024-37484 relates to Zephyr Project Manager. The Zephyr Project Manager product (affected versions from n/a up to 3.3.97) is vulnerable to Privilege Escalation via a User Meta Update when accessed by an authenticated user with LOW privileges. The issue is categorized under Improp er Privileg...

CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97...

CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97...

CVE-2024-37224

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71...

WordPress plugin Zephyr Project Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-27593 · Unknown · Zephyr Project Manager

Name of the Vulnerable Software and Affected Versions: Zephyr Project Manager versions n/a through 3.3.97 Description: The issue is related to Improper Privilege Management, which allows Privilege Escalation in the Zephyr Project Manager. Recommendations: For versions n/a through 3.3.97, update t...

WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by shaman0x01 Patchstack Alliance in WordPress Plugin Zephyr Project Manager versions = 3.3.97...

WordPress Zephyr Project Manager Plugin <= 3.3.97 is vulnerable to Privilege Escalation

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.97 Fixed in 3.3.99 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37484 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0ba7243a615b Credits shaman0x01 Required...

WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability

Directory Traversal vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin SP Project & Document Manager versions = 4.71...

CVE-2024-5899 Improper trust check in Bazel Build intellij plugin

When Bazel Plugin in intellij imports a project either using "import project" or "Auto import" the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance.createProject. This...

FreeBSD : kanboard -- Project Takeover via IDOR in ProjectPermissionController (91929399-249e-11ef-9296-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91929399-249e-11ef-9296-b42e991fc52e advisory. [email protected] reports: Kanboard is project management software that focuses on the...

CVE-2024-36399

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

DEBIAN-CVE-2024-36399

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...