1117 matches found
CVE-2025-22717 WordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through = 2.0.9...
CVE-2024-56238
CVE-2024-56238 describes a Missing Authorization vulnerability in the Floating Action Buttons plugin, allowing access to functionality not constrained by ACLs. Affected software: Floating Action Buttons (0.9.1 and earlier). The connected Red Hat and other entries corroborate the same CVEID and de...
CVE-2024-56225
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through = 4.10.56...
CVE-2024-56008
CVE-2024-56008 affects Spreadr Woocommerce Plugin for WordPress (
CVE-2024-54369
CVE-2024-54369 pertains to Zita Site Builder (WordPress) up to version 1.0.2, where Missing Authorization to Arbitrary Plugin Installation enables Accessing/Activating plugins without proper ACL checks. Connected Red Hat advisory and RH security notes describe the issue as a Missing Authorization...
CVE-2024-54256 WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through = 1.0.21...
CVE-2024-53826 WordPress WPCasa plugin <= 1.2.13 - Insecure Direct Object References (IDOR) vulnerability
Missing Authorization vulnerability in WPSight WPCasa wpcasa allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCasa: from n/a through = 1.2.13...
CVE-2024-53708 WordPress AI Quiz plugin <= 1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in kekotron AI Quiz ai-quiz allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AI Quiz: from n/a through = 1.1...
CVE-2024-49360 Path traversal in Sandboxie
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user UserA with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attack...
CVE-2024-49360 Path traversal in Sandboxie
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user UserA with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attack...
CVE-2024-49360
Sandboxie path traversal vulnerability (CVE-2024-49360) allows an authenticated, non-privileged user to read files created in other users’ sandboxes (C:\Sandbox\UserX\xxx). The root cause is failure to reset ACLs when a folder with malicious ACLs is created (e.g., C:\Sandbox\UserA), enabling acce...
CVE-2024-10396 Fileserver crash and possible information leak on StoreACL/FetchACL
An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to...
MGASA-2024-0342 Updated bind packages fix security vulnerabilities
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. CVE-2024-0760 Resolver caches and authoritative zone databases that...
CVE-2024-47359
Cross-Site Request Forgery CSRF vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through = 3.2.2...
CVE-2024-47321
Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through = 2.1.1...
CVE-2024-47308
Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through = 3.1.2...
CVE-2024-43998
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3...
CVE-2024-43979
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10...