CVE-2024-8516

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract limited post information from...

CVE-2024-8483

The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the staticcontent function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract potentially sensitive information...

PT-2024-39090 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.9 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on...

PT-2024-31207 · Gigastone · Gigastone Tr1 Travel Router R101

Name of the Vulnerable Software and Affected Versions: Gigastone TR1 Travel Router R101 version 1.0.2 Description: The issue allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the ssid parameter in the request. This enables the attack...

PT-2024-39278 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.5 Description: The issue is related to Stored Cross-Site Scripting via the piechart settings parameter due to insufficient input sanitization and output...

PT-2024-39404 · WordPress · Graphicsly

Name of the Vulnerable Software and Affected Versions: The Graphicsly plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticat...

WordPress MAS Static Content plugin <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure vulnerability

Authenticated Contributor+ Private Static Content Page Disclosure vulnerability discovered by emad in WordPress Plugin MAS Static Content versions = 1.0.8...

WordPress GutenGeek Free Gutenberg Blocks for WordPress plugin <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin GutenGeek Free Gutenberg Blocks for WordPress versions = 1.1.3...

CVE-2024-8436

The CVE CVE-2024-8436 affects the WP Easy Gallery – WordPress Gallery Plugin and is an authenticated SQL Injection vulnerability in versions up to 4.8.5. Exploitation requires subscriber-level access or higher and targets the edit_imageId and edit_imageDelete parameters, where insufficient escapi...

PT-2024-39266 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.12.2 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including private, draft, and...

WordPress MailChimp for Wordpress plugin <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Jorge Diaz ddiax in WordPress Plugin MC4WP versions = 4.9.16...

PT-2024-39127 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p16 Checkmk versions prior to 2.2.0p34 Description: The issue allows authenticated users to bypass two-factor authentication in the RestAPI of Checkmk. This enables attackers to access the system without providi...

WordPress WP Custom Fields Search plugin <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpcfs-preset Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Custom Fields Search versions = 1.2.35...

VulnCheck KEV: CVE-2023-25651

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak...

CVE-2022-39068

There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack...

PT-2024-32403 · Unknown · Apex Softcell Ld Geo

Name of the Vulnerable Software and Affected Versions: Apex Softcell LD Geo affected versions not specified Description: This issue exists due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this by manipulating the transactio...

CVE-2024-45815

A flaw was found in the backstage/plugin-catalog-backend package. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Mitigation Mitigation for this issue...

GHSA-3X3F-JCP3-G22J @backstage/plugin-catalog-backend Prototype Pollution vulnerability

Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Patches This has been fixed in the 1.26.0 release of the @backstage/plugin-catalog-backend...

CVE-2024-45815

CVE-2024-45815 – Prototype Pollution in @backstage/plugin-catalog-backend Affects Backstage (specifically the catalog-backend plugin). A malicious actor with authenticated access to a Backstage instance using the catalog backend can interrupt the service by sending a specially crafted query to th...

CVE-2024-45815 Prototype pollution in @backstage/plugin-catalog-backend

Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the 1.26.0 relea...