WordPress Clever Addons for Elementor Plugin <= 2.2.1 is vulnerable to Sensitive Data Exposure

Software Clever Addons for Elementor Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10357 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d35b93afd355 Credits Ankit Patel...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier are affected by a Sensitive Data Exposure vulnerability. The issue arises from a GET request to /user/getUserList, with authentication required. The exposure includes data for all registered users (user IDs, status, email addresses, roles, user type, license type) and...

CVE-2022-30361

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, roles, user type, license type, and personal detai...

CVE-2022-30361

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, roles, user type, license type, and personal detai...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, roles, user type, license type,...

CVE-2022-30361

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure via an unauthenticated GET request to /user/getUserType. The endpoint discloses data tied to the registered user: user ID, status, email, roles, user type, license type, and personal details such as first name, last name, gende...

CVE-2022-30354

OvalEdge 5.2.8.0 and earlier suffers a Sensitive Data Exposure via a GET to /user/getUserWithTeam, requiring authentication. The vulnerability discloses data associated with all registered user IDs. Affected component/endpoint: /user/getUserWithTeam. Root cause is exposure of user data through an...

CVE-2022-30354

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, roles, user type, license type,...

PT-2024-11557 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue is a Sensitive Data Exposure vulnerability that can be exploited via a GET request to "/user/getUserList". Authentication is required to exploit this issue. The disclosed informatio...

CVE-2024-49683 WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through = 1.3.5...

CVE-2024-49683 WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through = 1.3.5...

Directory Traversal

@vendure/asset-server-plugin is vulnerable to Directory Traversal. The vulnerability is due to improper validation in Vendure's asset server plugin, which allows an attacker to craft requests that traverse the server file system, retrieving arbitrary files including sensitive data and crashing th...

PT-2024-33139 · Unknown · Xiao He Smart

Name of the Vulnerable Software and Affected Versions: XIAO HE Smart version 4.3.1 Description: The issue is related to incorrect access control, allowing attackers to access sensitive information by analyzing the code and data within the APK file. Recommendations: For XIAO HE Smart version 4.3.1...

PT-2024-33480

Name of the Vulnerable Software and Affected Versions ZimaOS versions 1.2.4 and earlier Description The issue concerns the exposure of sensitive data through API endpoints, such as http:///v1/users/image?path=/var/lib/casaos/1/app order.json and...

CVE-2024-9530

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

PT-2024-39871 · Unknown · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to download any comment and metadata for any user, including sensitive information such as...

WordPress Qi Addons For Elementor Plugin <= 1.8.0 is vulnerable to Sensitive Data Exposure

Software Qi Addons For Elementor Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9530 Patch priority Low CVSS severity Low 4.3 Developer Qode Interactive PSID 6f7683e106bb Credits Ankit Patel...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.3.5...

WordPress News Kit Elementor Addons Plugin <= 1.2.1 is vulnerable to Sensitive Data Exposure

Software News Kit Elementor Addons Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1aff69c2a359 Credits Nishiv Required...