2533 matches found
CVE-2024-3983 WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...
WordPress plugin WooCommerce Customers Manager 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress HTML Forms plugin < 1.3.34 - Bulk Delete via CSRF vulnerability
Bulk Delete via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin HTML Forms versions 1.3.34...
CVE-2024-6412 HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Langflow 安全漏洞
Langflow is a Langflow open source visualization framework for building multi-agent and RAG applications. A security vulnerability exists in Langflow versions prior to 1.0.13, which stems from an elevation of privilege issue that allows a remote and less privileged attacker to gain super...
WordPress WP eMember plugin < 10.6.6 - Bulk Delete via CSRF vulnerability
Bulk Delete via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WP eMember versions 10.6.6...
CVE-2024-5076 WP eMember < 10.6.6 - Bulk Delete via CSRF
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
CVE-2024-5076 WP eMember < 10.6.6 - Bulk Delete via CSRF
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Exploit for Improper Validation of Specified Type of Input in Servicenow
CVE-2024-4879 Bulk scanning tool for ServiceNow CVE-2024-4879...
CVE-2024-1375
CVE-2024-1375 affects the WordPress Event post plugin. A missing nonce check in the save_bulkdatas function allows unauthorized bulk updates to post_meta_data in all versions up to 5.9.5. An unauthenticated attacker can exploit this by forging requests, requiring that a logged-in user be tricked ...
CVE-2024-1375 Event post <= 5.9.10 - Cross-Site Request Forgery
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the savebulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update postmetadata via a forged request, granted...
PT-2024-17987 · WordPress · Event Post Plugin For Wordpress
Name of the Vulnerable Software and Affected Versions: Event post plugin for WordPress versions up to, and including, 5.9.5 Description: The issue allows unauthorized bulk metadata updates due to a missing nonce check on the save bulkdatas function. This enables unauthenticated attackers to updat...
WordPress plugin Event post security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...
What’s New in Rapid7 Products & Services: Q2 2024 in Review
This quarter we continued to make investments that provide security professionals with a holistic, actionable view of their entire attack surface. In Q2, we focused on enhancing visualization, prioritization, and integration capabilities across our key products and services. Below we’ve highlight...
When spear phishing met mass phishing
Introduction Bulk phishing email campaigns tend to target large audiences. They use catch-all wordings and simplistic formatting, and typos are not uncommon. Targeted attacks take greater effort, with attackers sending personalized messages that include personal details and might look more like...
Malicious code in sap-bulk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 08cbb879a6aa696aa73710cb438ea1ed271c7f2d65a54b957d3a73920b4c5433 The OpenSSF Package Analysis project identified 'sap-bulk' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
WordPress plugin Media Hygiene security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
kernel: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass actlen in usbbulkmsg error path syzbot reported that actlen in kalmiasendinitpacket is uninitialized when passing it to the first usbbulkmsg error path. Jiri Pirko noted that it's pointless to pass it ...
Exploit for Path Traversal in Splunk
CVE-2024-36991 POC for CVE-2024-36991: This exploit will attem...
PT-2024-36695 · WordPress · The Quiz/Survey Master
Name of the Vulnerable Software and Affected Versions: The Quiz and Survey Master QSM WordPress plugin versions prior to 9.0.2 Description: The issue concerns a SQL injection due to the lack of validation and escaping of the question id parameter in the "qsm bulk delete question from database" AJ...