PT-2024-7861 · Unknown · Orchid Platform

Name of the Vulnerable Software and Affected Versions: Orchid Platform versions 8 through 14.42.x Description: The issue is a method exposure problem in the Orchid Platform’s asynchronous modal functionality, allowing attackers to call arbitrary methods within the Screen class. This could lead to...

PT-2024-16216

Name of the Vulnerable Software and Affected Versions Clever Addons for Elementor plugin for WordPress versions up to, and including, 2.2.1 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data...

CVE-2024-48238

WTCMS 1.0 is vulnerable to SQL Injection in the editpost method of /Admin\Controller\NavControl.class.php via the parentid parameter...

Best Courier Management System security vulnerabilities

Best Courier Management System is a courier management system by Mayuri K. Individual developer. A security vulnerability exists in Best Courier Management System version v.1.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the adminclass.php component...

PT-2024-33049 · Wtcms · Wtcms

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue concerns SQL Injection in the edit post method of the /Admin/Controller/NavControl.class.php file via the parentid parameter. This allows for potential exploitation. Recommendations: For WTCMS version...

PT-2024-33156 · Unknown · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Best courier management system version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the admin class.php component. This is due to a File Upload vulnerability in the Best courier management system in php...

CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local...

CVE-2024-47883

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local...

CVE-2024-9943: Cross-Site Request Forgery (CSRF)

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php...

ZZCMS code-related vulnerabilities

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter file in file 3/Ebbak5.1/upload/class/functions.php that can lead to unrestricted uploads...

apache-avro: Schema parsing may trigger Remote Code Execution (RCE)

A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special "java-class" attribute...

SUSE CVE-2022-49024

In the Linux kernel, the following vulnerability has been resolved: can: mcan: pci: add missing mcanclassfreedev in probe/remove methods In mcanpciremove and error handling path of mcanpciprobe, mcanclassfreedev should be called to free resource allocated by mcanclassallocatedev, otherwise there...

DEBIAN-CVE-2022-48948

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvcfunctionsetup permits control transfer requests with up to 64 bytes of payload UVCMAXREQUESTSIZE, data stage handler for OUT transfer uses memcpy to cop...

23andMe will retain your genetic information, even if you delete the account

Deleting your personal data from 23andMe is proving to be hard. There are good reasons for people wanting to delete their data from 23andMe: The DNA testing platform has a lot of problems, so let’s start with a recap. A little over a year ago, cybercriminals put up information belonging to as man...

Malicious code in class-py (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugin-transform-class-static-block (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9761 Malicious code in plugin-transform-class-static-block (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9754 Malicious code in plugin-bugfix-v8-static-class-fields-redefine-readonly (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugin-bugfix-v8-static-class-fields-redefine-readonly (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-48180: Unrestricted Upload of File with Dangerous Type

ClassCMS =4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code...