CVE-2024-12395: Improper Neutralization of Input During Web Page Generation

The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin WooCommerce Additional Fees On Checkout (Free) 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

PT-2024-36178 · Unknown · Vbsso-Lite

Name of the Vulnerable Software and Affected Versions: vBSSO-lite versions 1.4.3 and earlier Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability. This vulnerability allows for authentication bypass in vBSSO-lite. Recommendations: For...

fs/ntfs3: Additional check in ni_clear()

...

CVE-2024-44243

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2. An app may be able to modify protected parts of the file system...

Drupal core contains a potential PHP Object Injection vulnerability

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to...

GHSA-GVF2-2F4G-JQF4 Drupal core contains a potential PHP Object Injection vulnerability

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to...

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions

Identity security is all the rage right now, and rightfully so. Securing identities that access an organization's resources is a sound security model. But IDs have their limits, and there are many use cases when a business should add other layers of security to a strong identity. And this is what...

[SECURITY] Fedora 41 Update: python3.11-3.11.11-1.fc41

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...

PT-2024-17270

Name of the Vulnerable Software and Affected Versions Additional Custom Order Status for WooCommerce plugin for WordPress versions up to, and including, 1.6.0 Description The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2024-11814: Improper Neutralization of Input During Web Page Generation

The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwpwcosdeletefinished, wfwpwcosdeletefallbackfinished, wfwpwcosdeletefallbackordersupdated, and wfwpwcosdeletefallbackstatus parameters in all versions up to, and...

CVE-2024-20136

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09121847; Issue ID: MSV-1821...

CVE-2024-11418

CVE-2024-11418 is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Additional Order Filters for WooCommerce . The issue arises from insufficient input sanitization and output escaping of the shipping_method_filter parameter, affecting versions up to 1.21. Attackers can compe...

WordPress plugin Additional Order Filters for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

CVE-2024-11418: Improper Neutralization of Input During Web Page Generation

The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shippingmethodfilter' parameter in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Additional Order Filters for WooCommerce plugin <= 1.21 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Max Boll b0lli in WordPress Plugin Additional Order Filters for WooCommerce versions = 1.21...

CVE-2018-9483

In btadmremovesecdeventry of btadmact.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-10913

The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursiveunserializedreplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain i...

Moodle IDOR when deleting OAuth2 linked accounts

A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...

CVE-2024-48897 Moodle: idor in edit/delete rss feed

A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify...