CVE-2024-9531

CVE-2024-9531 affects MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution for WordPress. A missing capability check in mvx_sent_deactivation_request across versions up to 4.2.4 enables authenticated users with Subscriber+ privileges to trigger a canned email to the site admin...

CVE-2024-9531 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvxsentdeactivationrequest' function in all versions up to, and including, 4.2.4. This makes it possible f...

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle Database Management System allows a hacker to gain access to read, modify, or delete data, or to cause service interruptions.

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle MySQL database management system is related to deficiencies in the authentication process due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, or delet...

The vulnerability of the Auctions component of the Oracle Sourcing supply management platform, a part of the Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to create, modify, and delete data.

The vulnerability of the Auctions component of the Oracle Sourcing supply management platform, part of the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

CVE-2024-21166

...

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform allows a malicious individual to gain access to modify, add, and delete data.

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to the ability to modify, add, or delete...

The vulnerability of the FMW Control Plugin web interface of the Oracle Enterprise Manager Fusion Middleware Control software platform allows a attacker to disclose sensitive information and gain access to modify, add, or delete data.

The vulnerability of the FMW Control Plugin web interface of the Oracle Enterprise Manager Fusion Middleware software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to disclose sensitive information and gain access to the ability ...

The vulnerability of the Device Integration component of the Oracle MES for Process Manufacturing software solution, a part of the Oracle E-Business Suite, allows an intruder to gain unauthorized access to create, modify, and delete data.

The vulnerability of the Device Integration component of the Oracle MES for Process Manufacturing software solution, a part of the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gai...

CVE-2024-21096

...

CVE-2024-10003

CVE-2024-10003 (Rover IDX for WordPress) affects Rover IDX plugin, versions up to 3.0.0.2903. Root cause is a missing capability check on multiple functions, enabling authenticated attackers with subscriber-level access or higher to add, modify, or delete plugin options, potentially leading to un...

PT-2024-15968 · WordPress · Rover Idx Plugin

Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to, and including, 3.0.0.2903 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This makes it possible for...

CVE-2024-41713

A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the...

The vulnerability of the Site Hierarchy Flows component of the Oracle Site Hub data storage and management system, a part of the Oracle E-Business Suite, allows an attacker to access, modify, add, and delete data.

The vulnerability of the Site Hierarchy Flows component of the Oracle Site Hub data storage and management system, a part of the Oracle E-Business Suite automation system for enterprise activities, is related to authentication errors. Exploiting this vulnerability could allow an attacker to gain...

The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain access to data modification, addition, and deletion operations.

The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in the authentication process due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker to gain access to perform dat...

CVE-2024-48509

Learning with Texts LWT 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain...

The vulnerability of the Cost Planning component of the Oracle Cost Management system, a cost management solution within the Oracle E-Business Suite. This component allows attackers to modify, add, or delete data.

The vulnerability of the Cost Planning component of the Oracle Cost Management system, a cost management solution within the Oracle E-Business Suite, is related to deficiencies in the authorization process due to incorrect validation of input data. Exploiting this vulnerability could allow an...

The vulnerability of the Diagnostics component of the Oracle Applications Manager software, a business automation system for enterprises under the Oracle E-Business Suite, allows an attacker to modify, add, or delete data.

The vulnerability of the Diagnostics component of the Oracle Applications Manager application management tool within the Oracle E-Business Suite relates to deficiencies in the authentication process due to incorrect validation of input data. Exploiting this vulnerability could allow an attacker t...

The vulnerability of the Price List component in the Oracle Advanced Pricing price and discount management tool. This component is part of the Oracle E-Business Suite, a business automation system that allows unauthorized users to access, modify, add, or delete data.

The vulnerability of the Price List component in the Oracle Advanced Pricing price and discount management tool is related to deficiencies in the authorization process due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker to remotely access and modify, add...

PT-2024-33127 · Unknown · Learning With Texts

Name of the Vulnerable Software and Affected Versions: Learning with Texts LWT version 2.0.3 Description: The issue occurs due to the application's failure to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. Thi...

The vulnerability of the Field Service Engineer Portal component of the Oracle Field Service management platform allows a malicious individual to access, modify, add, and delete data. This component is part of the Oracle E-Business Suite, which is used for automating business processes in enterprises.

The vulnerability of the Field Service Engineer Portal component of the Oracle Field Service management platform, part of the Oracle E-Business Suite, is related to authentication errors. Exploiting this vulnerability could allow an attacker to gain access to modify, add, and delete data using th...