CVE-2024-10436

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the getconditionvalue function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute...

CVE-2024-10437 WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajaxenable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with...

CVE-2024-10437

CVE-2024-10437 affects the WordPress plugin “WPC Smart Messages for WooCommerce” (versions ≤ 4.2.1). description: a missing capability check in ajax_enable allows authenticated users with Subscriber-level access or higher to activate/deactivate smart messages. Impact: unauthorized modification of...

CVE-2024-10436

CVE-2024-10436 affects the WPC Smart Messages for WooCommerce WordPress plugin, with Local File Inclusion via the get_condition_value function in all versions up to and including 4.2.1. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary PHP files on t...

CVE-2024-10436 WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the getconditionvalue function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute...

WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Message Activation/Deactivation vulnerability discovered by Francesco Carlucci in WordPress Plugin WPC Smart Messages for WooCommerce versions = 4.2.1...

WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by theviper17y in WordPress Plugin WPC Smart Messages for WooCommerce versions = 4.2.1...

ABB Cylon Aspect 3.08.01 Active Debug Data Exposure

ABB Cylon Aspect 3.08.01 auth/ Active Debug Code Vulnerability Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: 3.08.01 Summary: ASPECT is an award-winning scalable building energy management and...

WordPress plugin WPC Smart Messages for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin WPC Smart Messages for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-16281 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to include and execute arbitrary files on the server via...

PT-2024-16282 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to activate or deactivate smart messages due to a missin...

WordPress WPC Smart Messages for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software WPC Smart Messages for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-10436 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 61988e9cc775 Credits theviper17y Required...

Philips Smart Wi-Fi LED 安全漏洞

Philips Smart Wi-Fi LEDs are a range of smart LED lights from the Dutch company Philips. The Philips Smart Wi-Fi LEDs contain a security vulnerability that originates from storing Wi-Fi credentials in plain text in the device's firmware, which allows an attacker with physical access to obtain the...

CVE-2024-48544

Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48545

Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48541

Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48548

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack...

CVE-2024-48540

Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7

Summary cURL libcurl, Apache Xerces2 Java, Apache Jena, Spring Framework, json-smart-v1 and json-smart-v2 , libxml2, Apache Standard Taglibs , Apache ActiveMQ, Apache Commons Codec are identified as vulnerable components with multiple reported vulnerabilities, CVE-2022-35260, CVE-2022-42915,...