3131 matches found
CVE-2024-10529
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteassistant function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2024-10529
CVE-2024-10529 affects the WordPress plugin Kognetiks Chatbot for WordPress (versions
CVE-2024-10531
The CVE CVE-2024-10531 affects the Kognetiks Chatbot for WordPress plugin for WordPress, versions up to and including 2.1.7. The root cause is a missing capability check in update_assistant(), enabling authenticated users with subscriber-level access and above to modify GTP assistants without aut...
CVE-2024-10530
CVE-2024-10530 concerns the WordPress plugin “Kognetiks Chatbot for WordPress” (versions ≤ 2.1.7). The vulnerability is due to a missing capability check in add_new_assistant(), allowing authenticated users with subscriber-level access and above to create new GTP assistants and thereby modify dat...
CVE-2024-10854 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10854
CVE-2024-10854 concerns the WordPress plugin Buy one click WooCommerce (<= 2.2.9). The root cause is a missing capability check on the AJAX action buy_one_click_import_options , allowing authenticated users with Subscriber-level access and above to modify/import plugin settings. The vulnerabil...
CVE-2024-10853
CVE-2024-10853 applies to Buy one click WooCommerce for WordPress (versions
flatpak: Access to files outside sandbox for apps using persistent= (--persist)
A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...
PT-2024-16345 · Kognetiks · Kognetiks Chatbot For Wordpress
Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress plugin versions up to, and including, 2.1.7 Description: The Kognetiks Chatbot for WordPress plugin is vulnerable to unauthorized modification of data due to a missing capability check on the delete assistant...
HPESBNW04726 rev.1 - HPE Telco IP Mediation Application, Multiple Vulnerabilities
Potential Security Impact: Local: Unauthenticated Arbitrary Code Execution, Server-Side Request Forgery SSRF, local memory corruption, Host Header Injection; Remote: Denial of Service DoS, SQL Injection, Server-Side Request Forgery SSRF, memory corruption, unathorized modification, Input Validati...
CVE-2024-10589
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the importsettings function in all versions up to, and including, 3.1.1. This makes it possible for authenticate...
CVE-2024-10294
The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21singlesignonsaveapisettings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings...
CVE-2024-10294
CVE-2024-10294 affects the WordPress CE21 Suite plugin. The root cause is a missing capability check in ce21_single_sign_on_save_api_settings, allowing unauthenticated attackers to modify plugin settings in versions up to 2.2.0. The impact is unauthorized modification of data/settings. Wordfence ...
CVE-2024-10535 Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...
CVE-2024-10535 Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...
CVE-2024-7429 Zotpress <= 7.3.12 - Missing Authorization
The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ZotpressprocessaccountsAJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and...
Improper Authorization
Overview volttron-core is a VOLTTRON™ is an open source platform for distributed sensing and control. The platform provides services for collecting and storing data from buildings and devices and provides an environment for developing applications which interact with that data. Affected versions ...
CVE-2024-10399
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsearchusers function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...
CVE-2024-9629
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with...
CVE-2024-9629
CVE-2024-9629 affects the WordPress plugin Contact Form 7 + Telegram (cf7-telegram) up to version 0.8.5. The root cause is a missing capability check in wpcf7_Telegram::ajax, enabling authenticated users with subscriber-level access and above to modify subscription state (approve, pause, refuse),...