CVE-2024-4733

CVE-2024-4733 affects ShiftController Employee Shift Scheduling WordPress plugin. Some versions up to 4.9.57 are vulnerable to PHP Object Injection via deserialization of untrusted input in the hc3_session cookie, exploitable by an authenticated attacker with contributor+ privileges to inject a P...

ShiftController Employee Shift Scheduling < 4.9.58 - Authenticated (Contributor+) PHP Object Injection

Description The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the hc3session-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with contributor access-level or...

CVE-2024-4666

CVE-2024-4666 applies to Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg (WordPress). It is a stored XSS vulnerability in multiple widgets across all versions up to 1.5.3, caused by insufficient input sanitization and inadequate output escaping on user-supplied att...

CVE-2024-4275

CVE-2024-4275 affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. The Stored XSS vulnerability is in the Interactive Circle widget due to insufficient input sanitization and output escaping on user-supplied attributes, allo...

PB MailCrypt <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The PB MailCrypt plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Mitsubishi Electric MELSEC iQ-R series Information Disclosure Vulnerability

The Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller from Mitsubishi Electric Japan. The Mitsubishi Electric MELSEC iQ-R series suffers from an information disclosure vulnerability that can be exploited by an authenticated, remote attacker to log in to the product and...

CVE-2024-1057

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuitebutton' shortcode in all versions up to, and including, 2.8.1 due to insufficient input...

CVE-2024-2103

Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5...

CVE-2024-2103 Inclusion of Undocumented Features

Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5...

Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied...

PT-2024-19631 · WordPress · Affiliate-Toolkit – Wordpress Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress versions up to, and including, 3.5.4 Description: The issue is related to a missing capability check on the atkp import product function, allowing authenticated attackers...

PT-2024-14994 · WordPress · The Meta Box – Wordpress Custom Fields Framework

Name of the Vulnerable Software and Affected Versions: The Meta Box – WordPress Custom Fields Framework plugin versions up to, and including, 5.9.2 Description: The issue is related to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode due to...

FreeBSD : mantis -- multiple vulnerabilities (1f0d0024-ac9c-11ee-8e91-1c697a013f4b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1f0d0024-ac9c-11ee-8e91-1c697a013f4b advisory. - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are...

CVE-2022-46141

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

Information disclosure

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

CVE-2022-46141

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

CVE-2022-46141

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

CVE-2022-46141

CVE-2022-46141 affects SIMATIC STEP 7 (TIA Portal): all versions before V19 are vulnerable to information disclosure that could allow a local attacker to obtain the access level password of S7-1200/S7-1500 CPUs when entered by a legitimate user in the hardware configuration. The Red Hat/Siemens a...

Siemens SIMATIC STEP 7 (TIA Portal)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

MantisBT < 2.25.8 Information Disclosure Vulnerability - Linux

MantisBT is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mantisbt:mantisbt";...