2273 matches found
CVE-2024-25595
CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...
CVE-2023-41956
The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...
CVE-2023-41954
The ProfilePress Membership Team plugin for WordPress is affected by an Improper Privilege Management vulnerability in versions through 4.13.1 . This flaw allows for unauthenticated limited privilege escalation , where an attacker can gain unauthorized access to restricted features or data. The i...
CVE-2023-41665
CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP
CVE-2023-41243
The WPvivid Backup and Migration WordPress plugin (versions 0.9.90 and earlier ) is affected by an Improper Privilege Management vulnerability. This flaw allows for Privilege Escalation , where an attacker with Subscriber privileges can potentially gain unauthorized access or control over the sys...
CVE-2023-38399
CVE-2023-38399 concerns a Local File Inclusion (path traversal) in WordPress plugin Phlox Portfolio by Averta. The vulnerability affects Phlox Portfolio versions up to 2.3.1 and is exploitable without authentication due to improper limitation of a pathname to a restricted directory. Patchstack an...
CVE-2023-25050
The Shortcodes Ultimate WordPress plugin (versions through 5.12.6 ) is vulnerable to an Absolute Path Traversal vulnerability. This flaw allows an attacker with Contributor privileges to perform an Arbitrary File Download , potentially exposing sensitive data. The root cause is an improper limita...
CVE-2022-45374
CVE-2022-45374 (YARPP for WordPress) : Local File Inclusion due to improper path handling in YARPP
CVE-2022-44581
CVE-2022-44581 affects the WordPress Defender Security plugin (WPMU DEV Defender Security) with versions up to 3.3.2. Multiple connected sources describe insecure storage of sensitive information and note that screen temporary files may expose sensitive data. Patchstack frames the issue as Broken...
CVE-2024-33861
Qt6-base is affected (CVE-2024-33861) due to an invalid pointer passed as a callback in QStringConverter, which could lead to stack modification and bypass of security restrictions. Multiple advisories (e.g., OSV/GLSA) reference fixes in qt6-base; remediation is to upgrade to the patched Qt6-base...
The vulnerability of the Linux operating system’s Intel Hardware Feedback Interface driver allows attackers to compromise the integrity and accessibility of protected information.
The vulnerability of the Intel Hardware Feedback Interface driver in the drivers/thermal/intel/intelhfi.c file of the Linux kernel is related to the improper use of a reserved buffer after resuming from sleep mode. Exploiting this vulnerability could allow an attacker to compromise the integrity...
The vulnerability of the btrfs_get_root_ref() function in the fs/btrfs/disk-io.c file of the Linux kernel’s file system allows a hacker to cause a service failure.
The vulnerability of the btrfsgetrootref function in the fs/btrfs/disk-io.c file of the Linux kernel’s file system is related to the repeated release of a reserved memory block. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2023-33327
CVE-2023-33327 refers to a high-severity Privilege Escalation in the WordPress Leyka plugin (versions
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
...
CVE-2024-27281
A vulnerability exists in RDoc versions 6.3.3 through 6.6.2, distributed in Ruby 3.x through 3.3.0. The root cause is the lack of restrictions on classes being restored when parsing .rdoc_options as a YAML file. This allows for object injection and subsequent remote code execution (RCE) . A simil...
CVE-2024-24833
CVE-2024-24833 affects the WordPress plugin Happy Addons for Elementor (Leevio) up to version 3.10.1, caused by broken access control (missing authorization) when cloning posts or adding rows. Patch 3.10.2 fixes the issue. If using this plugin, upgrade to 3.10.2 or later to mitigate the vulnerabi...
CVE-2022-40218
The CVE-2022-40218 entry concerns the WordPress plugin ThemeHunk Advance Product Search (WordPress TH Advance Product Search Plugin), affecting versions 1.1.4 and earlier. The root cause is a missing authorization check that allows an unauthenticated user to change plugin settings, enabling impac...
CVE-2023-27321
CVE-2023-27321 describes a DoS vulnerability in OPC Foundation UA .NET Standard’s OPC UA ConditionRefresh handling. The flaw allows an attacker to trigger a resource exhaustion condition on affected servers by sending a high volume of ConditionRefresh requests, potentially consuming all server re...
CVE-2024-23713
CVE-2024-23713 affects Google's Android Framework, specifically migrateNotificationFilter in NotificationManagerService.java. The root cause is improper input validation that can fail to persist notification settings, enabling local privilege escalation with no extra execution privileges required...