CVE-2024-6411

CVE-2024-6411 – ProfileGrid WordPress plugin : Privilege escalation in ProfileGrid – User Profiles, Groups and Communities was caused by lack of validation on the pm_upload_image AJAX action, allowing authenticated users with Subscriber+ access to elevate from a user to Administrator. Affected ve...

PT-2024-37604 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.8.9 Description: The issue is due to a lack of validation on user-supplied data in the 'pm upload image' AJAX action, allowing...

PT-2024-32172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel, where the lwt seg6 related BPF ops can be invoked via bpf test run without entering input action end bpf first. This is because the per-CPU...

CVE-2024-31312

In multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosure exposing played media with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-6069

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregisterinstalladdon function in...

CVE-2024-5856

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-6168 Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions

The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality...

CVE-2024-5856 Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-6180

CVE-2024-6180 — EventON WordPress plugin is vulnerable due to a missing capability check on the ajax action eventon_import_settings, affecting all versions up to 2.2.15. This allows unauthenticated attackers to modify plugin settings, including injecting stored XSS into settings displayed on the ...

Malicious code in action-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31baa3db4424164fa3d7884ba12d4c44fdfe3bc4db9eb835121b5adbeb9485db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7433 Malicious code in action-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31baa3db4424164fa3d7884ba12d4c44fdfe3bc4db9eb835121b5adbeb9485db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7432 Malicious code in uppgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eebd3367058aab97ddda392851ad10b2d7c94cce6268e0be365b5aa83069eb1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7421 Malicious code in branch-deploy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f8ee439aa1b1732d638e3b68c12f320056784b39327753fbd3ff9f476d39ace The OpenSSF Package Analysis project identified 'branch-deploy-action' @ 2.1.1 npm as malicious. It is considered malicious because: - The packa...

Malicious code in branch-deploy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f8ee439aa1b1732d638e3b68c12f320056784b39327753fbd3ff9f476d39ace The OpenSSF Package Analysis project identified 'branch-deploy-action' @ 2.1.1 npm as malicious. It is considered malicious because: - The packa...

OESA-2024-1810 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

MAL-2024-7214 Malicious code in @zitterorg/fugit-ex-neque (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f7f3694766a66580a12a7935f3749211f56225ef96551bdb577e24042976270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7113 Malicious code in @zitterorg/amet-accusamus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a6e9367b1e17e013e0885917212df32f875db4895d2226589d7fff0b9dfb50b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7376 Malicious code in @zitterorg/saepe-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b10349f2016d9a45288cebba6a70030779a7aca3990d8a1ebdd1f006d46c8500 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7124 Malicious code in @zitterorg/asperiores-molestias (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da08b0192ef24873742abe7437939f0b760152b8b6f51e0a8768dc6188fac210 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7368 Malicious code in @zitterorg/repellat-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0bc7fc3e505e9dd62355f7b3983ace743ffff1124063f9965a62dd31ebba429 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...