15030 matches found
CVE-2024-9609
CVE-2024-9609 affects LearnPress Export Import – WordPress extension for LearnPress (WordPress) up to version 4.0.4. The vulnerability is a reflected cross-site scripting flaw caused by insufficient input sanitization and output escaping in the learnpress_import_form_server parameter, enabling un...
CVE-2024-51156
07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery CSRF via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'...
MAL-2024-10710 Malicious code in prxy-chain (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ba7e4f495217937a8213c982cd27fd211680e174266b6ae21aa6c24beaebf20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10708 Malicious code in p-oauth2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1863799825b7c600296f1bea1286732b9e0b1268b0e663d8646f0b17419d00f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the Action Controller component of the Action Pack interpreter for Ruby allows a attacker to trigger a service failure.
The vulnerability of the Action Controller component of the Action Pack interpreter in Ruby is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures remotely...
The vulnerability of the Action Dispatch component in the Action Pack extension’s Ruby interpreter allows a attacker to trigger a service failure.
The vulnerability of the Action Dispatch component in the Action Pack extension’s Ruby interpreter involves unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
The vulnerability of the `plain_text_for_blockquote_node` function in the Action Text interpreter for Ruby allows a hacker to trigger a service failure.
The vulnerability of the plaintextforblockquotenode function in the Action Text interpreter for Ruby is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...
The vulnerability of the `block_format` function in the Action Text interpreter for Ruby allows a hacker to trigger a service failure.
The vulnerability of the blockformat function in the Action Text extension of the Ruby interpreter is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...
CVE-2024-10684 Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-10684 Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-10853
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-10854
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10854
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10853
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-10854
CVE-2024-10854 concerns the WordPress plugin Buy one click WooCommerce (<= 2.2.9). The root cause is a missing capability check on the AJAX action buy_one_click_import_options , allowing authenticated users with Subscriber-level access and above to modify/import plugin settings. The vulnerabil...
CVE-2024-10854 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10851 Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to injec...
PT-2024-16592 · WordPress · Buy One Click Woocommerce Plugin
Name of the Vulnerable Software and Affected Versions: Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description: The issue is related to a missing capability check on the removeorder AJAX action, allowing authenticated attackers with Subscriber-level access...
PT-2024-16591 · WordPress · Buy One Click Woocommerce Plugin
Name of the Vulnerable Software and Affected Versions: Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description: The issue arises from a missing capability check on the buy one click export options AJAX action, allowing authenticated attackers with...
MAL-2024-10611 Malicious code in blockypher (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 092ea3353b7f268f366debbde3d21eb6915d7825c7967ce0fecc4f6d2f483c2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...