CVE-2024-10673 Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the topstoreinstallandactivatecallback function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-10673

CVE-2024-10673 affects Top Store WordPress Theme up to version 1.5.4. The flaw is a missing capability check in top_store_install_and_activate_callback(), allowing authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX. Exploitati...

CVE-2024-10588

The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to obtain information from...

CVE-2024-10294

The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21singlesignonsaveapisettings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings...

CVE-2024-10294

The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21singlesignonsaveapisettings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings...

CVE-2024-10294 CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change

The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21singlesignonsaveapisettings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings...

CVE-2024-10294

CVE-2024-10294 affects the WordPress CE21 Suite plugin. The root cause is a missing capability check in ce21_single_sign_on_save_api_settings, allowing unauthenticated attackers to modify plugin settings in versions up to 2.2.0. The impact is unauthorized modification of data/settings. Wordfence ...

CVE-2024-10588

CVE-2024-10588 affects the Debug Tool WordPress plugin (all versions

The vulnerability of the hypervisor component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the hyperv component in the Linux operating system is related to the assignment of the NULL pointer in the sethvtscchangecb function. Exploiting this vulnerability can allow an attacker to cause a service failure...

K000148436: Linux kernel vulnerabilities CVE-2020-36558, CVE-2023-2002, CVE-2023-4622, and CVE-2023-4623

Security Advisory Description CVE-2020-36558 A race condition in the Linux kernel before 5.5.7 involving VTRESIZEX could lead to a NULL pointer dereference and general protection fault. CVE-2023-2002 A vulnerability was found in the HCI sockets implementation due to a missing capability check in...

Moodle's IDOR in badges allows deletion of arbitrary badges

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...

CVE-2024-43425

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

CVE-2024-43431 Moodle: idor in badges allows deletion of arbitrary badges

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...

CVE-2024-43431 Moodle: idor in badges allows deletion of arbitrary badges

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...

CVE-2024-43425 Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

CVE-2024-6626

The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to vie...

CVE-2024-10543

The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimationsgetcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVE-2024-6626

The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to vie...

CVE-2024-10543

CVE-2024-10543 affects Tumult Hype Animations plugin for WordPress. The vulnerability is a missing capability check in hypeanimations_getcontent that enables authenticated users with Subscriber-level access or higher to retrieve animation data. It affects all versions up to and including 1.9.14. ...

CVE-2024-10535 Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion

The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...