CVE-2023-37541

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios...

WordPress Plugin Zita Elementor Site Library Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-12638 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue is related to a broken access control, which may allow an unauthorized user to update data in certain scenarios. Recommendations: At the moment, there is no information...

HCL Technologies HCL Connections Security Breach

HCL Technologies HCL Connections is a suite of enterprise collaboration platforms from HCL Technologies, USA. A security vulnerability exists in HCL Connections that stems from allowing unauthorized users to update data under certain circumstances...

CVE-2024-1955

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...

WordPress plugin License Manager for WooCommerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in...

WordPress plugin Hide Dashboard Notifications security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2024-3627

The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible...

CVE-2024-5768 MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting

The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimoupdateprovider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

SUSE-SU-2024:1498-2 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - CVE-2024-21011: Fixed denial of service due to long Exception message logging JDK-8319851,bsc1222979 - CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup JDK-8315708,bsc1222987 -...

CVE-2024-5860

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tcdldeletetickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-1634

The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsbdisconnectsettings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to...

CVE-2024-5860

Tickera – WordPress Event Ticketing vulnerability (CVE-2024-5860): a missing capability check on the tc_dl_delete_tickets AJAX action allows authenticated users with Subscriber-level access and above to delete all event tickets. Affects all versions up to 3.5.2.8. The provided documents confirm t...

PT-2024-28021 · Shenzhen Guoxin · Shenzhen Guoxin Synthesis Image System

Name of the Vulnerable Software and Affected Versions: Shenzhen Guoxin Synthesis image system versions prior to 8.3.0 Description: The issue allows unauthorized user information retrieval. This is achieved via the "queryUser API" endpoint. Recommendations: For versions prior to 8.3.0, update to...

Shenzhen Guoxin Synthesis Image System Security Vulnerability

Shenzhen Guoxin Synthesis image system is an image system from Shenzhen Guoxin Synthesis, a company based in Shenzhen, China. A security vulnerability exists in Shenzhen Guoxin Synthesis Image System versions prior to 8.3.0 that originates from allowing unauthorized user information to be retriev...

WordPress plugin AI Infographic Maker security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Timetics security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-31495

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality...

The vulnerability of GE HealthCare’s ultrasonic diagnostic system’s Kiosk Mode allows intruders to bypass security restrictions, gain unauthorized access to protected information, and enhance their privileges.

The vulnerability of GE HealthCare’s ultrasonic diagnostic system’s Kiosk Mode feature is related to a breach in data protection mechanisms. Exploiting this vulnerability can allow attackers to circumvent security restrictions, gain unauthorized access to protected information, and enhance their...

The vulnerability of the VsApiNT module of the ApexOne Security Agent software in anti-virus programs from Trend Micro’s Apex One, and Apex One as a Service, allows attackers to gain unauthorized access to protected information.

The vulnerability of the VsApiNT module in the ApexOne Security Agent software of Trend Micro’s Apex One antivirus solutions is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected...