3270 matches found
CVE-2024-6397: Authentication Bypass Using an Alternate Path or Channel
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing...
WordPress Olive One Click Demo Import Plugin <= 1.1.2 is vulnerable to Sensitive Data Exposure
Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-38749 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3944618737f2 Credits Peng Zhou Require...
CVE-2024-28828
Cross-Site request forgery in Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, and = 2.0.0p39 EOL could lead to 1-click compromize of the site...
UBUNTU-CVE-2024-28828
Cross-Site request forgery in Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, and = 2.0.0p39 EOL could lead to 1-click compromize of the site...
CVE-2024-28828 1-Click compromize via CSRF
Cross-Site request forgery in Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, and = 2.0.0p39 EOL could lead to 1-click compromize of the site...
CVE-2024-28828
Cross-Site request forgery in Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, and = 2.0.0p39 EOL could lead to 1-click compromize of the site...
CVE-2024-28828
CVE-2024-28828 applies to Checkmk: CSRF vulnerability could allow 1-click site compromise in affected builds before 2.3.0p8, before 2.2.0p29, before 2.1.0p45, and
Checkmk Security Vulnerabilities
Checkmk is an IT monitoring platform from Checkmk, Inc. A security vulnerability exists in Checkmk that stems from the presence of cross-site request forgery, which could lead to a one-click site compromise...
WordPress Poll 2.3.6 SQL Injection
Exploit Title: WordPress Poll Plugin SQL Injection Date: 2024-07-06 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-poll/ Version 2.3.6 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to TS Poll Create Pool Use Theme and...
WordPress One Click Order Re-Order plugin <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin One Click Order Re-Order versions = 1.1.9...
WordPress One Click Order Re-Order Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)
Software One Click Order Re-Order Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5641 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a046b0fddb6b Credits Lucio Sá...
PT-2024-36812
Name of the Vulnerable Software and Affected Versions One Click Order Re-Order plugin for WordPress versions up to, and including, 1.1.9 Description The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the ced ocor sav...
WordPress plugin One Click Order Re-Order Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...
CVE-2024-5641: Missing Authorization
The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cedocorsavegeneralsetting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level...
WordPress alfred24 Click & Collect plugin <= 1.1.7 - Malicious Polyfill.io Embed vulnerability
Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin alfred24 Click & Collect versions = 1.1.7...
WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Backdoor
Software alfred24 Click & Collect Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cf5f2b39e0cf Credits Sansec.io Required privilege Unauthenticated Published 3...
libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic
A flaw was found in LibreOffice. Unchecked script execution in graphic on-click binding allows an attacker to create a document, which, without a prompt, will execute scripts built into LibreOffice when clicking a graphic. These scripts were previously deemed trusted but are now deemed untrusted...
CVE-2024-34595
Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities...
WordPress Ad Invalid Click Protector (AICP) plugin 1.2.9 - Injected Backdoor vulnerability
Injected Backdoor vulnerability discovered by WordFence in WordPress Plugin Ad Invalid Click Protector AICP versions 1.2.9...
