CVE-2024-10852

CVE-2024-10852 affects the WordPress plugin “Buy one click WooCommerce” (versions up to 2.2.9). The flaw is a missing capability check on the buy_one_click_export_options AJAX action, enabling authenticated attackers with Subscriber-level access and above to export plugin settings. Impact, as sta...

CVE-2024-10852 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buyoneclickexportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level acce...

PT-2024-34481 · Unknown · Itsourcecode Construction Management System

Name of the Vulnerable Software and Affected Versions: Itsourcecode Construction Management System version 1.0 Description: A SQL injection issue in the print.php file allows remote attackers to execute arbitrary SQL commands via the map id parameter. This enables attackers to potentially extract...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Execution of arbitrary code User Rights - Execution of arbitrary code System Rights - Obtaining...

CVE-2024-46956

A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access...

Devolutions DVLS 安全漏洞

Devolutions DVLS is a globally popular, full-featured, self-hosted password management platform. A security vulnerability exists in Devolutions DVLS version 2024.3.6 and prior versions that stems from improper access control. An attacker exploiting the vulnerability could gain access to sensitive...

The vulnerability in the CORS mechanism of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to bypass security restrictions, gain unauthorized access to protected information, and execute arbitrary code.

The vulnerability of the CORS mechanism in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to the lack of measures taken to protect the structure of web pages during the processing of the resource://devtools path. Exploiting this vulnerability allows an attacker to bypas...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

CVE-2024-46956 affects Artifex Ghostscript (psi/zfile.c) with an out-of-bounds data access in filenameforall that can lead to arbitrary code execution on Ghostscript versions up to 10.04.0. Connected advisories confirm this vulnerability and provide patch guidance; mitigation is to update Ghostsc...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-52312

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments...

WordPress plugin Attesa Extra 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

data.all 安全漏洞

data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that a member of the data.all management team with access to an AWS account owned by a customer deploying data.all may be able to extract user data...

CVE-2024-51030

A SQL injection vulnerability in manageclient.php and viewcab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within the database...

Mars: Users Data Exposure via Insecure Endpoint

An insecure endpoint on the Mars Royal Canin website exposed sensitive customer information without proper authentication. Personal data, including full names, phone numbers, email addresses, physical addresses, and postal codes, was accessible through a simple API endpoint that could be accessed...

The vulnerability of the Party Search UI component of the software for working with customers in Oracle Trading Community, a business automation system from Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to read, create, modify, or delete data.

The vulnerability of the Party Search UI component of the software for working with Oracle Trading Community clients, a business automation system within the Oracle E-Business Suite, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker,...