PT-2024-24069

Name of the Vulnerable Software and Affected Versions Rara Theme The Conference versions 1.2.0 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicatio...

PT-2024-24582 · WordPress · Wpwax Legal Pages

Name of the Vulnerable Software and Affected Versions: wpWax Legal Pages versions 1.4.2 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24566 · Unknown · Codemenschen Gift Vouchers

Name of the Vulnerable Software and Affected Versions: Codemenschen Gift Vouchers versions through 4.4.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-24434 · Unknown · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher versions through 4.0.12 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows for potential exploitation ...

PT-2024-24029 · Creativethemes · Blocksy

Name of the Vulnerable Software and Affected Versions: Blocksy versions 2.0.22 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Creative Themes HQ Blocksy. This issue allows an attacker to perform unintended actions on a user's account. Recommendations: For versions 2.0.22...

PT-2024-24401 · WordPress · Wp Migration Plugin Db & Files – Wp Synchro

Name of the Vulnerable Software and Affected Versions: WP Migration Plugin DB & Files – WP Synchro versions 1.11.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WP Migration Plugin DB & Files – WP Synchro. This issue allows for malicious requests to be made on behal...

PT-2024-24431 · Unknown · Bwl Advanced Faq Manager

Name of the Vulnerable Software and Affected Versions: BWL Advanced FAQ Manager versions 2.0.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

PT-2024-24307 · Typps · Typps Calendarista Basic Edition

Name of the Vulnerable Software and Affected Versions: Typps Calendarista Basic Edition versions 3.0.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations:...

PT-2024-24025 · Smash Balloon · Smash Balloon Social Post Feed

Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed versions through 4.2.1 Description: A Cross-Site Request Forgery CSRF issue affects the Smash Balloon Social Post Feed. This type of issue allows an attacker to perform unintended actions on a web application th...

PT-2024-24585 · Unknown · Wappointment

Name of the Vulnerable Software and Affected Versions: Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment versions n/a through 2.6.0 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially force the serve...

Crelly Slider <= 1.4.5 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Crelly Slider" 2. Add a slid...

Adobe Illustrator Multiple Vulnerabilities (APSB24-25) - Mac OS X

Adobe Illustrator is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:illustrator";...

PT-2024-10421 · Kde +4 · Kde Plasma Workspace +4

Name of the Vulnerable Software and Affected Versions: KDE Plasma Workspace versions prior to 5.27.11.1 KDE Plasma Workspace 6.x versions prior to 6.0.5.1 Description: The issue allows connections via ICE based purely on the host, i.e., all local connections are accepted. This enables another use...

PT-2024-17931 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce WordPress plugin versions prior to 8.6 Description: The issue allows users with at least the contributor role to access products they should not have access to, including private, draft, and trashed products. Recommendations: For...

PT-2024-23940 · Unknown · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads versions 3.2.6 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the...

PT-2024-5180 · Adobe · Illustrator

Name of the Vulnerable Software and Affected Versions: Adobe Illustrator versions 28.4, 27.9.3 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker...

PT-2024-14158 · WordPress · Woocommerce Shipping Per Product

Name of the Vulnerable Software and Affected Versions: WooCommerce Shipping Per Product versions 2.5.4 and earlier Description: A Missing Authorization issue has been identified. This issue affects the WooCommerce Shipping Per Product plugin. Recommendations: For versions 2.5.4 and earlier, updat...

PT-2024-11539 · Mautic · Mautic

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 Description: An authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery SSRF vulnerability...

GHSA-X565-32QP-M3VF phin may include sensitive headers in subsequent requests after redirect

Impact Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled. Patches The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations. Workarounds N/A...

PT-2024-3150 · WordPress · Blog2Social

Name of the Vulnerable Software and Affected Versions: Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to, and including, 7.4.2 Description: The issue is related to insufficient protection of sensitive data, allowing unauthenticated attackers to view limited...