4568 matches found
WordPress Restrict User Access – Membership Plugin with Force Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Software Restrict User Access – Membership Plugin with Force Type Plugin Vulnerable versions = 2.5 Fixed in 2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29138 Patch priority Medium CVSS severity Medium 7.1 Developer DEV Institute PSID 211a6e23f622 Credits...
PT-2024-11747 · Siklu · Siklu Tg Terragraph
Name of the Vulnerable Software and Affected Versions: Siklu TG Terragraph devices versions prior to 2.1.1 Description: The issue allows attackers to discover valid, randomly generated credentials via the GetCredentials endpoint. This can potentially lead to unauthorized access. Recommendations:...
CVE-2024-27085 Denial of service through invites in Discourse
Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...
PT-2024-40186 · Python · Python
Name of the Vulnerable Software and Affected Versions: Python versions prior to 0.4. Description: The issue affects users who do not want tracebacks included in their logs when errors occur in their code. If a user's code inadvertently includes sensitive information in a traceback and a malicious...
PT-2024-22389
Name of the Vulnerable Software and Affected Versions gpac version 2.3-DEV-rev921-g422b78ecf-master Description The issue is related to an out of boundary read vulnerability via the gf dash setup period function in the media tools/dash client.c file at line 6374. This vulnerability can allow a...
PT-2024-13998 · Sirv · Sirv
Name of the Vulnerable Software and Affected Versions: Sirv versions through 7.1.2 Description: The issue is related to a Missing Authorization vulnerability in Sirv. This vulnerability affects Sirv from version n/a through 7.1.2. Recommendations: For versions through 7.1.2, update to a version...
PT-2024-20301 · Gnuboard · Gnuboard
Name of the Vulnerable Software and Affected Versions: Gnuboard g6 versions before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5 Description: A Cross Site Scripting XSS issue allows remote attackers to execute arbitrary code via the wr content parameter. This enables attackers to inject...
TikTok faces ban in US unless it parts ways with Chinese owner ByteDance
The House of Representatives has passed a bill that would effectively ban TikTok from the US unless Chinese owner ByteDance gives up its share of the immensely popular app. TikTok is an immensely popular social media platform that allows users to create, share, and discover, short video clips. It...
PT-2024-20561 · Mha Sistemas · Mha Sistemas Armhazena
Name of the Vulnerable Software and Affected Versions: MHA Sistemas arMHAzena version 9.6.0.0 Description: A problematic vulnerability has been found in the Cadastro Page component, allowing for cross-site scripting through the manipulation of the Query argument. This issue can be exploited...
PT-2024-20586 · Unknown · Surya2Developer Hostel Management Service
Name of the Vulnerable Software and Affected Versions: Surya2Developer Hostel Management Service version 1.0 Description: A vulnerability has been found in the HTTP POST Request Handler component, specifically in the file /check availability.php. The manipulation of the oldpassword argument leads...
PT-2024-21805
Name of the Vulnerable Software and Affected Versions Support App versions prior to 2.5.1 Rev 2 Description The issue is related to the postinstall installer script, which can be abused to execute arbitrary code as root due to the use of the shebang !/bin/zsh. When the installer is executed, it...
PT-2024-22428
Name of the Vulnerable Software and Affected Versions greykite version 1.0.0 Description The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an arbitrary file upload vulnerability in the load obj function at /templates/pickle utils.py. Recommendations For...
CVE-2024-1083
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content...
CVE-2024-0687
The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API...
Cross site scripting
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.15.1 due to insufficient input sanitizati...
Information disclosure
The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API...
Code injection
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content...
Cross site scripting
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's reg-select-role shortcode in all versions up to, and including, 4.15.0 due to insufficient...
CVE-2024-1083
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content...
