CVE-2024-3848

creationtimestamp| type| source ---|---|--- 2024-11-30 13:48:14+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-3848.yaml...

WordPress Social Sharing Plugin – Sassy Social Share plugin <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter vulnerability

Reflected Cross-Site Scripting via heateormastodonshare Parameter vulnerability discovered by mikemyers in WordPress Plugin Sassy Social Share versions = 3.3.69...

WordPress Wallet for WooCommerce plugin <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types vulnerability

Authenticated Subscriber+ Incorrect Conversion between Numeric Types vulnerability discovered by stealthcopter in WordPress Plugin TeraWallet – For WooCommerce versions = 1.5.6...

Eaton 9PX Insufficiently Protected Credentials (CVE-2018-9279)

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage. This plugin only works with Tenable.ot. Pleas...

WordPress WOOCS – WooCommerce Currency Switcher plugin <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin FOX versions = 1.4.2.2...

WordPress Skt NURCaptcha plugin <= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Skt NURCaptcha versions = 3.5.0...

WordPress FluentSMTP plugin <= 2.2.82 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Leo in WordPress Plugin FluentSMTP versions = 2.2.82...

WordPress YaDisk Files plugin <= 1.2.5 - Contributor+ Stored XSS via Shortcode vulnerability

Contributor+ Stored XSS via Shortcode vulnerability discovered by WPscan in WordPress Plugin YaDisk Files versions = 1.2.5...

WordPress April's Call Posts plugin <= 2.1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin April's Call Posts versions = 2.1.1...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by WordFence in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.4.2...

WordPress WP-Orphanage Extended plugin <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation vulnerability

Cross-Site Request Forgery to Orphan Account Privilege Escalation vulnerability discovered by SOPROBRO in WordPress Plugin WP-Orphanage Extended versions = 1.2...

CVE-2024-10220 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, aws-efs-csi-driver-fips, argocd-image-updater-fips, nodetaint, rancher-webhook, kubernetes-dns-node-cache-fips, local-static-provisioner-fips, local-static-provisioner, argocd-image-updater, kubeflow-pipelines, k8s-device-plugin,...

WordPress Ditty plugin < 3.1.47 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ditty versions 3.1.47...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.3.3...

A Bag of RATs: VenomRAT vs. AsyncRAT

Introduction Remote access tools RATs have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT. These are open-sourc...

Judge0 Sandbox Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Judge0 sandbox escape', 'Description' = %q Judge0 does not account for symlinks placed inside the sandbox directory, which can be leveraged by an...

Judge0 Sandbox Escape Exploit

Judge0 does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. This module requires Metasploit: https://metasploit.com/download Current source:...

WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Office Locator versions = 1.3.0...

WordPress SEO Plugin by Squirrly SEO plugin < 12.3.21 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SEO Plugin by Squirrly SEO versions 12.3.21...

SUSE CVE-2024-53074

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't leak a link on AP removal Release the link mapping resource in AP removal. This impacted devices that do not support the MLD API 9260 and down. On those devices, we couldn't start the AP again after the ...