CVE-2024-23510

Cross-Site Request Forgery CSRF vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8...

CVE-2024-29926

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes WC Builder allows Stored XSS.This issue affects WC Builder: from n/a through 1.0.18...

CVE-2024-30192

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GS Plugins GS Pins for Pinterest allows Stored XSS.This issue affects GS Pins for Pinterest: from n/a through 1.8.2...

PT-2024-22937 · WordPress · The Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress versions up to, and including, 20231101 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and...

CVE-2024-24799

Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2...

VulnCheck KEV: CVE-2024-30221

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart.This issue affects Sunshine Photo Cart: from n/a through 3.1.1...

CVE-2023-27608

Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0...

CVE-2022-38057

Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1...

PT-2024-11726 · Sharethis · Sharethis Dashboard For Google Analytics

Name of the Vulnerable Software and Affected Versions: ShareThis Dashboard for Google Analytics versions through 3.1.4 Description: The issue is related to a Missing Authorization vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide ...

Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Note: This requires WooCommerce to be...

VulnCheck KEV: CVE-2024-30194

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through = 3.1.1...

New Go loader pushes Rhadamanthys stealer

Malware loaders also known as droppers or downloaders are a popular commodity in the criminal underground. Their primary function is to successfully compromise a machine and deploy one or multiple additional payloads. A good loader avoids detection and identifies victims as legitimate i.e. not...

PT-2024-16312 · WordPress · The Page Builder Gutenberg Blocks – Coblocks

Name of the Vulnerable Software and Affected Versions: The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress versions up to, and including, 3.1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Icon Widget due to insufficient input sanitization and...

PT-2024-22369 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A vulnerability was found in lakernote EasyAdmin, affecting unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be...

CVE-2024-27964

Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9...

PT-2024-21204 · Skymoonlabs · Skymoonlabs Moveto

Name of the Vulnerable Software and Affected Versions: Skymoonlabs MoveTo versions n/a through 6.2 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain featur...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: buf, tkn, kaniko, loki, wolfictl, melange, dagger, spire-server-fips, cilium-cli, docker-compose, zot, kubescape, trivy, syft, crossplane, cadvisor-fips, kargo, up, buildkitd, aactl, prometheus, ctop, ko, spire-server, cadvisor, grype, conftest-fips, conftest...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: buf, tkn, kaniko, loki, wolfictl, melange, dagger, spire-server-fips, cilium-cli, docker-compose, zot, kubescape, trivy, syft, crossplane, cadvisor-fips, kargo, up, buildkitd, aactl, prometheus, ctop, ko, spire-server, cadvisor, grype, conftest-fips, conftest...

kube-controller-manager: malformed HPA v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

PrestaShop Best-Kit Pop-up Security Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop Best-Kit Pop-up v.1.7.2 and earlier versions, which stems from...