PT-2024-30461 · WordPress · Wp Data Access

Name of the Vulnerable Software and Affected Versions: WP Data Access versions through 5.5.7 Description: A Cross-Site Request Forgery CSRF issue affects the WP Data Access plugin, allowing potential attacks. Upgrade to a newer version to protect against this issue. Recommendations: For versions...

WordPress plugin WP Data Access 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress plugin Shared Files 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the Date Picker function in Mozilla Firefox and Firefox ESR browsers allows a malicious actor to provide arbitrary permissions and gain unauthorized access to data or functions.

The vulnerability of the Date Picker function in Mozilla Firefox and Firefox ESR browsers is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to provide arbitrary permissions and gain unauthorized access to data or function...

ROS-20240826-23

A vulnerability in the Blender three-dimensional computer graphics software suite is related to the lack of validation for values less than 0. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data, compromise its integrity, and cause a denial of...

Kashipara Music Management System SQL Injection Vulnerability (CNVD-2024-37436)

Kashipara Music Management System is a music management system from Kashipara. Kashipara Music Management System v1.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the email parameter of /music/ajax.php?action=login against external SQL input, which c...

PT-2024-30027 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Management System version bae5aa Description: A SQL injection issue was discovered in the School Management System, allowing unauthorized data access and manipulation via the sid parameter at the "/search.php?action=2" endpoint. This...

Ghost 安全漏洞

Ghost is a hosting service from Ghost Open Source. A security vulnerability exists in Ghost versions v4.46.0 through prior to v5.89.5 that stems from improper authentication and allows an attacker to perform member-only actions and read member information...

The vulnerability of the Hotspot component in Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and the Oracle Java SE software platform allows a malicious individual to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Hotspot component in Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and the Oracle Java SE software platform is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized acce...

PT-2024-5821

Name of the Vulnerable Software and Affected Versions FastAdmin versions prior to 1.3.4.20220530 Description A problematic issue exists in FastAdmin related to improper path restriction within the /index/ajax/lang component. This allows for path traversal, potentially enabling remote attackers to...

PT-2024-8614 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw was found in Moodle related to local file inclusion when restoring incorrect block backups. This issue may allow a remote attacker to access confidential data. The estimated number of...

WordPress plugin InPost for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Data Access versions = 5.5.7...

WordPress WP Data Access Plugin <= 5.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Data Access Type Plugin Vulnerable versions = 5.5.7 Fixed in 5.5.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43295 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d55a2a229cca Credits Ananda Dhakal...

The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, allows an attacker to gain unauthorized access to read, modify, or delete data.

The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, relates to improper authorization. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data...

The vulnerability of the Personalization component of the Oracle Applications Framework, a web application development platform, within the Oracle E-Business Suite, allows an intruder to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Personalization component of the Oracle Applications Framework, a platform for developing web applications in enterprise automation systems within the Oracle E-Business Suite, is related to improper authentication. Exploiting this vulnerability allows an attacker to gain...

Vulnerabilities fixed in Adobe InDesign

Adobe has fixed vulnerabilities in InDesign. A malicious party could exploit the vulnerabilities to cause a denial-of-service, execute arbitrary code with the victim's privileges and potentially gain access to sensitive data. Successful exploitation requires the malicious party to trick the victi...

Vulnerabilities fixed in Adobe Dimension

Adobe has fixed vulnerabilities in Dimension. A malicious party could exploit the vulnerabilities to execute arbitrary code with the victim's privileges, or to gain access to sensitive data. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. Adobe...

Vulnerabilities fixed in Ivanti Avalanche

Ivanti has fixed vulnerabilities in Avalanche. A malicious party could exploit the vulnerabilities to cause a denial-of-service, access sensitive data and potentially execute arbitrary code on the system. To successfully achieve code execution, the malicious party must have elevated privileges...

PT-2024-37370 · Rockwell Automation · Datamosaix

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: An improper authentication issue exists, allowing a malicious user to generate cookies for any user ID without a username or password. This could enable the malicious user to take...