WordPress plugin ARForms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin All Bootstrap Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-16578 · WordPress · Flixita

Name of the Vulnerable Software and Affected Versions: Flixita theme for WordPress versions up to, and including, 1.0.82 Description: The issue is related to Reflected Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows unauthenticated...

PT-2024-34758 · WordPress · Wordpress Auction Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Auction Plugin versions n/a through 3.7 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Ni CRM Lead versions = 1.3.0...

WordPress Verowa Connect plugin <= 3.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Colin Xu in WordPress Plugin Verowa Connect versions = 3.0.1...

WordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Yusuf Patchstack Alliance in WordPress Plugin Prodigy Commerce versions = 3.0.8...

WordPress Login With OTP plugin <= 1.4.2 - Authentication Bypass via Weak OTP vulnerability

Authentication Bypass via Weak OTP vulnerability discovered by István Márton in WordPress Plugin Login With OTP versions = 1.4.2...

WordPress Pubnews theme <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation vulnerability

Unauthenticated Arbitrary Plugin Installation vulnerability discovered by Kevin Murphy knmurphy in WordPress Theme Pubnews versions = 1.0.7...

CVE-2024-51546

Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

CVE-2024-51546

CVE-2024-51546 affects ABB ASPECT Enterprise v3.08.02, NEXUS Series v3.08.02 and MATRIX Series v3.08.02, with credentials disclosure enabling access to on-board project backup bundles. Connected sources (including Exploit DB, Red Hat/US-CISA advisories and NC SC) describe this as a cookie/credent...

WordPress Simple Redirection plugin <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect vulnerability

Cross-Site Request Forgery to Arbitrary Site Redirect vulnerability discovered by SOPROBRO in WordPress Plugin Simple Redirection versions = 1.5...

kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

kernel: s390/qeth: Fix kernel panic after setting hsuid

A flaw was found in the Linux kernel's s390/qeth component. A local attacker with privileges to manage network devices could trigger a kernel panic by setting the hsuid attribute on an IQD Layer3 device while its network interface is active. This occurs because the kernel attempts to execute a nu...

PT-2024-17454 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: horilla versions up to 1.2.1 Description: A critical vulnerability was found in horilla, affecting the function request new/get employee shift/create reimbursement/key result current value update/create meetings/create skills. The manipulatio...

WordPress TI WooCommerce Wishlist plugin <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access vulnerability

Missing Authorization to Unauthenticated Plugin Setup Wizard Access vulnerability discovered by abrahack in WordPress Plugin TI WooCommerce Wishlist versions = 2.9.1...

WordPress WP Job Manager – Company Profiles plugin <= 1.7 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Job Manager – Company Profiles versions = 1.7...

CVE-2024-11782

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

Zyxel VMG4005-B50A 安全漏洞

The Zyxel VMG4005-B50A is a modem from China Heqin Zyxel. A security vulnerability exists in Zyxel VMG4005-B50A V5.15 ABQA.2.2 version C0 and earlier versions. An attacker could exploit the vulnerability to execute operating system commands on a vulnerable device...

WordPress Spectra plugin <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Team Widget vulnerability discovered by zer0gh0st in WordPress Plugin Spectra versions = 2.16.2...