CVE-2024-11740

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WordPress plugin Download Manager 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

DEBIAN-CVE-2024-53580

iperf v3.17.1 was discovered to contain a segmentation violation via the iperfexchangeparameters function...

iperf 安全漏洞

iperf is an ESnet open source tool for actively measuring the maximum bandwidth achievable on an IP network. A security vulnerability exists in iperf version v3.17.1, which stems from a segment error in the iperfexchangeparameters function...

WordPress plugin Hack-Info 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2023-33215

Missing Authorization vulnerability in Taggbox Taggbox taggbox-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through = 3.3...

WordPress Push Monkey Pro plugin <= 3.9 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart versions = 3.9...

WordPress AI Post Generator | AutoWriter plugin <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion vulnerability

Missing Authorization to Authenticated Contributor+ Post/Page Deletion vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin AI Post Generator | AutoWriter versions = 3.5...

SiYuan 路径遍历漏洞

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A path traversal vulnerability exists in SiYuan versions prior to 3.1.16, which stems from a lack of proper validation of path parameters and an arbitrary file read vulnerability...

SUSE-SU-2024:4291-1 Security update for python312

This update for python312 fixes the following issues: - CVE-2024-12254: Fixed unbounded memory buffering in SelectorSocketTransport.writelines bsc1234290 Other fixes: - Updated to version 3.12.8 - Remove -IVendor/ from python-config bsc1231795...

Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

sigstore-python 安全漏洞

sigstore-python is a Python tool for generating and verifying Sigstore signatures from the sigstore open source. A security vulnerability exists in sigstore-python versions prior to 2.0.0 through 3.6.0, which stems from insufficient validation of integration time in v2 and v3 bundles, and can cau...

BYD Dilink Headunit System 安全漏洞

BYD Dilink Headunit System is an in-vehicle operating system of the Chinese company BYD BYD. A security vulnerability exists in BYD Dilink Headunit System version v3.0 to v4.0. An attacker can exploit the vulnerability to bypass authentication via brute force attack...

Malicious code in prettier-v3-for-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 522c1e741b8482af7e3577e20c83b8e29a0f217b9c951d0e815e5c01af165408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51615 WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through = 3.7...

WordPress plugin WordPress Auction Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-53472

WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery CSRF...

CVE-2024-53472

CVE-2024-53472 affects WeGIA v3.2.0, with a Cross-Site Request Forgery (CSRF) vulnerability. CVSS v3.1 base score 8.8 (HIGH); attack vector NETWORK, requiring user interaction, with confidentiality, integrity, and availability impacts all High. Root cause is CSRF in the web application; exploitat...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A security vulnerability exists in WeGIA version v3.2.0. An attacker exploiting this vulnerability could perform a cross-site request forgery attack...

PT-2024-17362 · WordPress · Classic Addons – Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Classic Addons – WPBakery Page Builder plugin for WordPress versions up to, and including, 3.0 Description: The issue allows authenticated attackers with Contributor-level access and above, and permissions granted by an Administrator, to...