Google Is Adding Passkey Support for Its Most Vulnerable Users

Google is bringing the password-killing “passkey” tech to its Advanced Protection Program users more than a year after rolling them out broadly...

CVE-2023-7061

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make...

CVE-2023-7062

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2024-37501

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3...

CVE-2024-37501 WordPress Advanced Classifieds & Directory Pro plugin <= 3.1.3 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3...

CVE-2024-37501

The CVE-2024-37501 entry concerns PluginsWare Advanced Classifieds & Directory Pro with an authenticated Local File Inclusion (LFI) vulnerability. Affected versions are up to 3.1.3 (reported as n/a through 3.1.3). The root cause is an improper pathname limitation that permits traversal to restric...

kernel: Reserved fields in guest message responses may not be zero initialized

A flaw was found in some AMD CPUs where the guest message responses have not been zero-initialized. This issue may allow a local attacker with the ability to run arbitrary code on a container or virtual machine to discover sensitive information contained in the host system's memory...

WordPress Advanced AJAX Page Loader plugin <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability

Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Advanced AJAX Page Loader versions = 2.7.7...

WordPress Advanced File Manager Shortcodes plugin <= 2.4 - Authenticated (Contributor+) Directory Traversal vulnerability

Authenticated Contributor+ Directory Traversal vulnerability discovered by Colin Xu in WordPress Plugin File Manager Advanced Shortcode versions = 2.4...

WordPress Advanced File Manager Shortcode plugin <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Colin Xu in WordPress Plugin File Manager Advanced Shortcode versions = 2.5.3...

CVE-2024-37172

SAP S/4HANA Finance Advanced Payment Management does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity...

CVE-2024-37172

CVE-2024-37172 affects SAP S/4HANA Finance (Advanced Payment Management). The issue is an insufficient authorization check for an authenticated user, enabling privilege escalation. Impact is described as low for confidentiality and availability, with no effect on integrity. No exploitation status...

CVE-2024-39118

CVE-2024-39118 affects Mommy Heather Advanced Backups up to v3.5.3. The vulnerability allows an attacker to write arbitrary files by restoring a crafted backup. Connected sources (Red Hat, PT-Security, etc.) confirm the affected software and the remediation guidance: upgrade to a version later th...

WordPress plugin Advanced AJAX Page Loader security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Advanced AJAX Page Loader Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Advanced AJAX Page Loader Type Plugin Vulnerable versions = 2.7.7 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6310 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID b14ebfbe3313 Credits István Márto...

CVE-2024-39118

Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up...

CVE-2024-39118

Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up...

WordPress File Manager Advanced Shortcode Plugin <= 2.4 is vulnerable to Directory Traversal

Software File Manager Advanced Shortcode Type Plugin Vulnerable versions = 2.4 Fixed in 2.4.1 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2023-7062 Patch priority Low CVSS severity Low 7.7 Developer Claim ownership PSID a83d051bcbb6 Credits Colin Xu Required privilege...

Advanced Backups Security Vulnerability

Advanced Backups is a powerful backup mod for My World game by the individual developer Heather White. A security vulnerability exists in Advanced Backups v3.5.3 and earlier versions, which stems from a vulnerability that allows an attacker to write to arbitrary files by restoring a carefully...

WordPress plugin Advanced Classifieds & Directory Pro path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...