WordPress plugin Alemha watermarker security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-28767 · WordPress · Social Pixel

Name of the Vulnerable Software and Affected Versions: The Social Pixel WordPress plugin versions through 2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

PT-2024-21715 · Toshiba Tec · Toshiba Tec E-Studio Multi-Function Peripheral +44

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An attacker with admin access can install rogue applications. There is no information provided about the estimated number of potentially affected device...

PT-2024-25958 · Terramaster · Terramaster Tos

Name of the Vulnerable Software and Affected Versions: TerraMaster TOS firmware versions through 5.1 Description: The issue concerns hardcoded credentials in the firmware, allowing a remote attacker to login to the mail or webmail server. These credentials can also be used to access the...

CVE-2024-25052

IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363...

CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that...

PT-2024-22651 · Dell · Dell Scg

Name of the Vulnerable Software and Affected Versions: Dell SCG versions prior to 5.24.00.00 Description: The issue is related to an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST APIs. A remote low privileged attacker could potentially...

D-Link DIR-605L 安全漏洞

The D-Link DIR-605L is a wireless router from China's AUO D-Link. A hard-coded password vulnerability exists in D-Link DIR-605L v2.13B01, which can be exploited by an attacker to log in as root and gain administrator privileges...

PT-2024-20720 · Ibm · Ibm Jazz Reporting Service

Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service version 7.0.3 Description: The issue concerns the storage of user credentials in plain clear text, which can be accessed by an admin user. Recommendations: For IBM Jazz Reporting Service version 7.0.3, consider...

CVE-2024-1576

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09...

CVE-2024-1576 SQL Injection in MegaBIP

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09...

PT-2024-22653 · Dell · Dell Client Bios

Name of the Vulnerable Software and Affected Versions: Dell Client BIOS affected versions not specified Description: The issue is related to an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to...

PT-2024-5657

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Panorama affected versions not specified Description The issue is related to an arbitrary file upload vulnerability, allowing an authenticated read-write administrator with access to the web interface to disrupt system...

CVE-2024-4902

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘courseid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

PT-2024-32659 · WordPress · Wp Backpack

Name of the Vulnerable Software and Affected Versions: WP Backpack WordPress plugin versions through 2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

PT-2024-26889 · WordPress · Music Store

Name of the Vulnerable Software and Affected Versions: Music Store - WordPress eCommerce versions prior to 1.1.14 Description: A SQL injection issue allows a remote authenticated attacker with administrative privileges to execute arbitrary SQL commands, potentially obtaining or altering informati...

Tutor LMS – eLearning and online course solution < 2.7.2 -Authenticated (Administrator+) SQL Injection

Description The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘courseid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

PT-2024-33320 · WordPress · The Tutor Lms

Name of the Vulnerable Software and Affected Versions: The Tutor LMS – eLearning and online course solution plugin for WordPress versions up to, and including, 2.7.1 Description: The issue is related to time-based SQL Injection via the course id parameter due to insufficient escaping on the...

Improper Permission Check

Wagtail is vulnerable to Improper Permission Check. The vulnerability is due to an improperly applied permission check in the wagtail.contrib.settings module, allowing users with admin access to modify settings models without proper permissions...

WordPress Simple Ajax Chat plugin < 20240412 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by fourcade in WordPress Plugin Simple Ajax Chat versions 20240412...