WordPress Smart Forms plugin <= 2.6.91 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Smart Forms versions = 2.6.91...

WordPress Smart Forms Plugin <= 2.6.91 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions = 2.6.91 Fixed in 2.6.92 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33593 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 810e0b29d7f7 Credits Dhabaleshwar Das Required...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from the use of the createfromblueprint built-in function may lead to a security issue...

WordPress Smart Maintenance Mode Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart Maintenance Mode Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-33638 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 65450ffbae04 Credits LeNgocHoa...

Welotec SMART EMS 安全漏洞

Welotec SMART EMS is a solution for centralized management of distributed devices from Welotec. A security vulnerability exists in Welotec SMART EMS versions prior to 3.1.4 that stems from the presence of a clickjacking vulnerability that could trick a user into performing an unexpected action...

Improper Synchronisation

https://github.com/evmos/evmos/ is vulnerable to Improper Synchronisation. The vulnerability is due to a lack of synchronization between two states during transaction execution, allowing for arbitrary token minting. This exploit occurs because the stateDB.Commit method updates the Cosmos SDK...

WordPress The Smart Slider 3 Plugin < 3.5.1.23 Improper Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextendweb:smartslider3"; if description...

ROS-20240422-01

Vulnerability in the OpenSC smart card software toolkit and libraries is related to a bug in the AuthentIC driver and occurs during card registration using pkcs15-init. a bug in the AuthentIC driver and occurs during the card registration process using pkcs15-init, when a user or administrator...

CVE-2024-4019

A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has...

CVE-2024-4019 Byzoro Smart S80 Management Platform importhtml.php deserialization

A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has...

CVE-2024-4019 Byzoro Smart S80 Management Platform importhtml.php deserialization

A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has...

CVE-2024-4019

CVE-2024-4019 affects Byzoro Smart S80 Management Platform (up to 20240411). The vulnerability is in an unknown function of /importhtml.php, where manipulation of the sql argument leads to deserialization. It enables a remote attack and the exploit has been disclosed publicly. Multiple sources (N...

Byzro Networks Smart S80 Management Platform 代码问题漏洞

Byzro Networks Smart S80 is an Internet behavior management product from Byzro Networks. A code issue vulnerability exists in Byzro Networks Smart S80 Management Platform, which originates from /importhtml.php containing an unknown function that causes deserialization via the parameter sql...

CVE-2024-32597 WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7...

Improper Access Control

github.com/evmos/evmos is vulnerable to Improper Access Control. The vulnerability is due to Evmos allowing the creation of a vesting account at a designated address for smart contracts on the EVM, enabling attackers to front-run the creation of a contract and block legitimate contract deployment...

WordPress Plugin WP Smart Import 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Evmos vulnerable to unauthorized account creation with vesting module

Impact What kind of vulnerability is it? Who is impacted? Using the vesting module, a malicious attacker can create a new vesting account at a given address, before a contract is created on that address. Addresses of smart contracts deployed to the EVM are deterministic. Therefore, it would be...

GHSA-M99C-Q26R-M7M7 Evmos vulnerable to unauthorized account creation with vesting module

Impact What kind of vulnerability is it? Who is impacted? Using the vesting module, a malicious attacker can create a new vesting account at a given address, before a contract is created on that address. Addresses of smart contracts deployed to the EVM are deterministic. Therefore, it would be...

CVE-2023-45209

An information disclosure vulnerability exists in the web interface /cgi-bin/downloadconfig.cgi functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger...

CVE-2023-45744

A data integrity vulnerability exists in the web interface /cgi-bin/uploadconfig.cgi functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...