Fedora 40 : chromium (2024-b92c0289c9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b92c0289c9 advisory. Update to 130.0.6723.91 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2024-38653 · WordPress · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Name of the Vulnerable Software and Affected Versions: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin versions prior to 1.6.7.55 Description: The issue is related to the lack of sanitization and escaping of some Notification settings in the plugin,...

PT-2024-30308 · Unknown · Typesquare Webfonts

Name of the Vulnerable Software and Affected Versions: TypeSquare Webfonts versions 2.0.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 2.0.7 and earlier,...

PT-2024-30392 · Unknown · Wp Search Analytics

Name of the Vulnerable Software and Affected Versions: WP Search Analytics versions 1.4.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP Search Analytics...

PT-2024-30479 · Woocommerce · Wpc Frequently Bought Together

Name of the Vulnerable Software and Affected Versions: WPC Frequently Bought Together for WooCommerce versions prior to 7.1.9 Description: The issue affects the WPC Frequently Bought Together for WooCommerce plugin due to a Missing Authorization vulnerability. This vulnerability allows for the...

PT-2024-30786 · Unknown · Envira Photo Gallery

Name of the Vulnerable Software and Affected Versions: Envira Photo Gallery versions 1.8.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery, which allows exploiting incorrectly configured access control security...

PT-2024-30332 · Tutor Lms · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS versions 2.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Tutor LMS versions 2.7.3 and...

PT-2024-32526 · WordPress · Wp Sunshine Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: WP Sunshine Sunshine Photo Cart versions 3.2.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For WP...

PT-2024-30378 · Unknown · Creativemotion Social Slider Feed

Name of the Vulnerable Software and Affected Versions: creativemotion Social Slider Feed versions through 2.2.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-28592 · Unknown · Fetch Designs Sign-Up Sheets

Name of the Vulnerable Software and Affected Versions: Fetch Designs Sign-up Sheets versions 2.2.12 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Fetch...

Important: qt5-qtbase

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

PT-2024-30842 · Cozythemes · Cozythemes Blockbooster

Name of the Vulnerable Software and Affected Versions: CozyThemes Blockbooster versions 1.0.10 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For CozyThemes Blockbooste...

PT-2024-30469 · Fonts · Fonts

Name of the Vulnerable Software and Affected Versions: Fonts versions through 3.7.7 Description: The issue is related to a Missing Authorization vulnerability in the Fonts Plugin, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-27580 · Unknown · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core versions 5.4.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 5.4.8 and earlier, update...

PT-2024-27440 · Unknown · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro versions n/a through 3.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: Fo...

PT-2024-27419 · WordPress · Wpmet Elements Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: Wpmet Elements kit Elementor addons versions 3.1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This means...

PT-2024-16129 · WordPress · Group Chat & Video Chat By Atomchat

Name of the Vulnerable Software and Affected Versions: Group Chat & Video Chat by AtomChat plugin for WordPress versions up to, and including, 1.1.5 Description: The vulnerability is a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping on user-supplied...

Important: qt5-qtxmlpatterns

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

Important: qt5-qtcanvas3d

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

PT-2024-32957 · Cubewp · Cubewp

Name of the Vulnerable Software and Affected Versions: CubeWP – All-in-One Dynamic Content Framework versions 1.1.15 and earlier Description: The issue affects the CubeWP – All-in-One Dynamic Content Framework due to a Missing Authorization vulnerability. This vulnerability allows for the...