WordPress WP MultiTasking plugin <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Michelle Porter in WordPress Plugin WP MultiTasking versions = 0.1.17...

CVE-2024-28808

An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications...

PT-2024-22580 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the web interface of the affected software, which contains hidden functionality. This allows a remote authenticated attacker to access reserved information by accessing...

CVE-2024-8965

The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress OSM plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via osmmap and osmmapv3 Shortcodes vulnerability discovered by Peter Thaleikis in WordPress Plugin OSM versions = 6.1.0...

WordPress Premium Addons for Elementor plugin <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Media Grid Widget vulnerability discovered by zer0gh0st in WordPress Plugin Premium Addons for Elementor versions = 4.10.52...

WordPress Product Enquiry for WooCommerce plugin <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php vulnerability

Authenticated Author+ PHP Object Injection in enquirydetail.php vulnerability discovered by Francesco Carlucci in WordPress Plugin Product Enquiry for WooCommerce versions = 2.2.33.33...

PT-2024-38111 · WordPress · Eventin

Name of the Vulnerable Software and Affected Versions: Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress versions up to, and including, 4.0.8 Description: The Eventin plugin for WordPress is vulnerable to Local File Inclusion via multiple style parameters. This...

WordPress Themedy Toolbox plugin <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by Francesco Carlucci in WordPress Plugin Themedy Toolbox versions = 1.0.15...

WordPress Form Maker plugin <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Joel Indra in WordPress Plugin Form Maker by 10Web versions = 1.15.27...

WordPress GF Custom Style plugin <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin GF Custom Style versions = 2.0...

Synology Drive 日志信息泄露漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A log information disclosure vulnerability exists in Synology Drive versions prior to 3.3.0-15082, which stems...

PT-2024-39516 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authenticatio...

PT-2024-24273 · Ibm · Ibm Cognos Command Center

Name of the Vulnerable Software and Affected Versions: IBM Cognos Command Center versions 10.2.4.1 through 10.2.5 Description: The issue could disclose highly sensitive user information to an authenticated user with physical access to the device. Recommendations: For versions 10.2.4.1 and 10.2.5,...

WordPress Prisna GWT - Google Website Translator plugin <= 1.4.11 - Authenticated (Admin+) PHP Object Injection vulnerability

WordPress Prisna GWT - Google Website Translator plugin = 1.4.11 - Authenticated Admin+ PHP Object Injection vulnerability discovered by Lesor101 in WordPress Plugin Prisna GWT – Google Website Translator versions = 1.4.11...

CVE-2024-8668

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input...

CVE-2024-8516

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract limited post information from...

CVE-2024-8483

The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the staticcontent function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract potentially sensitive information...

PT-2024-39090 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.9 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on...

PT-2024-31207 · Gigastone · Gigastone Tr1 Travel Router R101

Name of the Vulnerable Software and Affected Versions: Gigastone TR1 Travel Router R101 version 1.0.2 Description: The issue allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the ssid parameter in the request. This enables the attack...