WordPress plugin InPost for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Data Access versions = 5.5.7...

WordPress WP Data Access Plugin <= 5.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Data Access Type Plugin Vulnerable versions = 5.5.7 Fixed in 5.5.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43295 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d55a2a229cca Credits Ananda Dhakal...

The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, allows an attacker to gain unauthorized access to read, modify, or delete data.

The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, relates to improper authorization. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data...

The vulnerability of the Personalization component of the Oracle Applications Framework, a web application development platform, within the Oracle E-Business Suite, allows an intruder to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Personalization component of the Oracle Applications Framework, a platform for developing web applications in enterprise automation systems within the Oracle E-Business Suite, is related to improper authentication. Exploiting this vulnerability allows an attacker to gain...

Vulnerabilities fixed in Adobe InDesign

Adobe has fixed vulnerabilities in InDesign. A malicious party could exploit the vulnerabilities to cause a denial-of-service, execute arbitrary code with the victim's privileges and potentially gain access to sensitive data. Successful exploitation requires the malicious party to trick the victi...

Vulnerabilities fixed in Adobe Dimension

Adobe has fixed vulnerabilities in Dimension. A malicious party could exploit the vulnerabilities to execute arbitrary code with the victim's privileges, or to gain access to sensitive data. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. Adobe...

Vulnerabilities fixed in Ivanti Avalanche

Ivanti has fixed vulnerabilities in Avalanche. A malicious party could exploit the vulnerabilities to cause a denial-of-service, access sensitive data and potentially execute arbitrary code on the system. To successfully achieve code execution, the malicious party must have elevated privileges...

PT-2024-37370 · Rockwell Automation · Datamosaix

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: An improper authentication issue exists, allowing a malicious user to generate cookies for any user ID without a username or password. This could enable the malicious user to take...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in various products such as SAP Business Objects, SAP HANA, Netweaver and Document Builder. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Server Side Request Forgery SSRF. - Cross-Site...

Improper Access Control

github.com/clastix/kamaji is vulnerable to Improper Access Control. The vulnerability is due to inadequate use of an "open at the top" range definition in RBAC for etcd roles, which allows some TCPs API servers to read, write, and delete data of other control planes...

CVE-2024-41733

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...

CVE-2024-41732

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read ...

Pepperl+Fuchs ICDM-RX 跨站脚本漏洞

The Pepperl+Fuchs ICDM-RX is a series of gateway devices from Pepperl+Fuchs Germany. A cross-site scripting vulnerability exists in the Pepperl+Fuchs ICDM-RX. An attacker could exploit this vulnerability to obtain information from a user or reboot the affected device once...

PT-2024-29625 · Unknown · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V2.0 Description: The affected application does not properly handle cacheable HTTP responses in the web service, which could allow an attacker to read and modify data stored in the local cache...

Vulnerabilities fixed in Zabbix

Vulnerabilities have been fixed in Zabbix. A malicious party could exploit the vulnerabilities to cause a denial-of-service, gain access to sensitive data, or potentially execute arbitrary code with application privileges. To execute arbitrary code, the malicious party needs prior elevated...

TECNO com.transsion.carlcare 安全漏洞

TECNO com.transsion.carlcare is a mobile application from TECNO China. A security vulnerability exists in TECNO com.transsion.carlcare. An attacker can exploit the vulnerability to obtain sensitive information...

PT-2024-26855 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8003 Description: The issue concerns an authenticated SQL Injection vulnerability in the aggregate reports' search option. This allows attackers to inject malicious SQL code, potentially leadi...

Kamaji 安全漏洞

Kamaji is a Kubernetes control plane manager open-sourced by Clastix Labs. A security vulnerability exists in Kamaji version 1.0.0 and earlier. An attacker exploited the vulnerability to cause certain TCP API servers to be able to read, write, and delete data...

CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature

The U.S. Cybersecurity and Infrastructure Security Agency CISA has disclosed that threat actors are abusing the legacy Cisco Smart Install SMI feature with the aim of accessing sensitive data. The agency said it has seen adversaries "acquire system configuration files by leveraging available...