CVE-2024-56044

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplmsplugin allows Authentication Bypass.This issue affects WPLMS: from n/a through = 1.9.9...

CVE-2024-56068

Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through = 2.3.3...

CVE-2024-56039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through 1.9.9.7.7...

CVE-2024-56229

Cross-Site Request Forgery CSRF vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.6...

CVE-2024-56508

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the LinkAce. This issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

GHSA-C9F5-29F6-C35W Browsershot Improper Input Validation vulnerability

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note:...

CVE-2024-4995 Protocol Downgrade in Wapro ERP Desktop

Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0...

Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from...

CVE-2024-8972

CVE-2024-8972 describes an SQL injection in Mobil365 Informatics’ Saha365 App caused by improper neutralization of special elements in SQL commands. Affected: Saha365 App prior to 30.09.2024. Root cause: improper neutralization of dynamic SQL. Impact as per sources: high confidentiality, integrit...

CVE-2024-35230 Welcome and About GeoServer pages communicate version and revision information

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use including library and components used. This information is sensitive...

CVE-2024-35230

CVE-2024-35230 affects GeoServer (Java) where the welcome and about pages disclose version and revision information of the server and components. This information exposure can aid fingerprinting of the running software. The issue has been patched in version 2.26.0; users should upgrade to 2.26.0 ...

CVE-2024-54382

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through = 5.1.5...

CVE-2024-54250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through = 3.0.8...

CVE-2024-54341

CVE-2024-54341 affects LabelGrid Tools (LabelGrid Tools plugin) up to version 1.3.58, with an Improper Neutralization of Input During Web Page Generation leading to Reflected XSS. Connected sources confirm the issue and indicate a patched state; exploitation details are not provided in the suppli...

CVE-2024-54322

CVE-2024-54322 is a Reflected XSS in the Media Downloader plugin for WordPress (versions up to 0.4.7.4). The connected Wordfence record explicitly maps CVE-2024-54322 to Media Downloader

CVE-2024-54315 WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NicheAddons Events Addon for Elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through 2.2.2...

CVE-2024-54295

CVE-2024-54295 affects ListApp Mobile Manager. The issue is Missing Authorization to Privilege Escalation leading to Authentication Bypass (CVE-2024-54295). CVSS 3.1 base score 9.8 (CRITICAL); attack vector NETWORK, no user interaction required, impact to confidentiality, integrity, and availabil...

CVE-2024-54261

CVE-2024-54261 is a SQL Injection vulnerability affecting the WordPress plugin TAX SERVICE Electronic HDM (HK Digital Agency LLC) with affected versions from n/a up to 1.1.2. Public sources indicate a patched version release to address this issue (e.g., WordPress CVE entry and Patchstack referenc...

CVE-2024-54243

CVE-2024-54243 concerns the WordPress Echoza plugin where improper input neutralization during web page generation leads to a stored XSS (Echoza &lt;= 0.1.1). The vulnerability affects Echoza versions up to 0.1.1 and is documented across multiple feeds as Cross-Site Scripting with Stored XSS impa...