Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Description Path traversal This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the...

WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin WP SendFox versions = 1.3.1...

VulnCheck KEV: CVE-2017-20194

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form...

WordPress Sina Extension for Elementor Plugin <= 3.5.7 is vulnerable to Sensitive Data Exposure

Software Sina Extension for Elementor Type Plugin Vulnerable versions = 3.5.7 Fixed in 3.5.8 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9540 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 04af03084bc5 Credits Nishiv Requir...

VulnCheck KEV: CVE-2022-4972

The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive...

WordPress WP SendFox Plugin <= 1.3.1 is vulnerable to Sensitive Data Exposure

Software WP SendFox Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-49284 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb07ea17c0a2 Credits Joshua Chan...

WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Contact Forms, Live Support, CRM, Video Messages versions = 1.10.2...

Log Injection

io.quarkiverse.cxf, quarkus-cxf is vulnerable to Log Injection. The vulnerability is due to misconfiguration of logging settings, which results in passwords and other secrets being logged; specific configurations, such as enabled SOAP logging and access to application logs, allow attackers to...

WordPress Elementor Website Builder Plugin <= 3.24.5 is vulnerable to Sensitive Data Exposure

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.24.5 Fixed in 3.24.6 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-6757 Patch priority Low CVSS severity Low 4.3 Developer Elementor PSID f4cfefcf22b1 Credits stealthcopter Required...

WordPress Elementor Addon Elements Plugin <= 1.13.8 is vulnerable to Sensitive Data Exposure

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.13.8 Fixed in 1.13.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8902 Patch priority Low CVSS severity Low 4.3 Developer WPVibes PSID ba1eb37881f7 Credits Ankit Patel Required...

PT-2024-33225 · Ilife · Ilife

Name of the Vulnerable Software and Affected Versions: ILIFE version 1.8.7 Description: An issue in the ILIFE app allows a remote attacker to obtain sensitive information via the firmware update process. This occurs during the firmware update process, potentially exposing sensitive data...

CVE-2024-8902

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the rendercolumn function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level...

WordPress plugin WP Post Author SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress Bot for Telegram on WooCommerce Plugin <= 1.2.4 is vulnerable to Sensitive Data Exposure

Software Bot for Telegram on WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Sensitive Data Exposure CVE CVE-2024-9821 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4a69a61df293 Credits István Márton Required...

Plug n Play Camera com.wisdomcity.zwave 安全漏洞

Plug n Play Camera com.wisdomcity.zwave is a camera driver from Plug n Play. A security vulnerability exists in Plug n Play Camera com.wisdomcity.zwave version 1.1.0, which stems from contains a vulnerability that allows remote attackers to obtain sensitive information through the firmware update...

Shelly com.home.shelly 安全漏洞

Shelly com.home.shelly is a firmware program from Shelly, Inc. A security vulnerability exists in Shelly com.home.shelly version 1.0.4, which stems from a contained vulnerability that allows remote attackers to obtain sensitive information through the firmware update process...

PYSEC-2024-219

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves insecure communication between the FRP Fast Reverse Proxy client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and rea...

CVE-2024-47168 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.6.11 is vulnerable to Sensitive Data Exposure

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.6.11 Fixed in 5.6.12 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8913 Patch priority Low CVSS severity Low 6.5 Developer POSIMYTH Innovations PSID...

WordPress Keep Backup Daily plugin <= 2.1.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Keep Backup Daily versions = 2.1.1...