PT-2024-28503 · WordPress · Wp To Do

Name of the Vulnerable Software and Affected Versions: WP To Do plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...

WordPress WP To Do plugin <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings vulnerability

Authenticated Admin+ Stored Cross-Site Scripting via Settings vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin WP To Do versions = 1.3.0...

WordPress WP To Do plugin <= 1.3.0 - Multiple CSRF vulnerability

Multiple CSRF vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin WP To Do versions = 1.3.0...

WordPress WP To Do Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP To Do Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3943 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 03b3682f0365 Credits Benedictus Jovan aillesiM...

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()

Description The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage function. This makes it possible for unauthenticated attackers to add new todo items via ...

WordPress WP To Do Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software WP To Do Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3946 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e067fe768425 Credits Benedictus Jovan aillesiM Require...

SUSE CVE-2021-47531

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix mmap to include VMIO and VMDONTDUMP In commit 510410bfc034 "drm/msm: Implement mmap as GEM object function" we switched to a new/cleaner method of doing things. That's good, but we missed a little bit. Before that...

Cesanta mjs 安全漏洞

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. It is designed for microcontrollers with limited resources. The main design goals are a small footprint and simple C / C ++ interoperability. A security vulnerability exists in Cesanta mjs version 2.20.0, which originate...

GitLab 13.2 < 13.4.7 / 13.5 < 13.5.5 / 13.6 < 13.6.2 (CVE-2020-26412)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. CVE-2020-26412 Note that Nessus has not...

Cybozu Garoon security bypass vulnerability (CNVD-2024-29666)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A security bypass vulnerability exists in Cybozu Garoon, which stems from improper restriction of certain...

Cybozu Garoon 安全漏洞

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A security bypass vulnerability exists in Cybozu Garoon, which stems from improper restriction of certain...

WordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Do Truong Giang Patchstack Alliance in WordPress Plugin Auto Affiliate Links versions = 6.4.3.1...

PT-2024-25918 · Undefined · Undefined

CVE-2024-34466 Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-34467. Reason: This candidate is a reservation duplicate of CVE-2024-34467. Notes: All CVE users should reference CVE-2024-344... https://t.co/OYipp6gBHK...

WordPress Auto Affiliate Links Plugin <= 6.4.3.1 is vulnerable to SQL Injection

Software Auto Affiliate Links Type Plugin Vulnerable versions = 6.4.3.1 Fixed in 6.4.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-34386 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 901e8da7d177 Credits Do Truong Giang Required privilege Editor...

SUSE CVE-2024-26944

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free in dozonefinish Shinichiro reported the following use-after-free triggered by the device replace operation in fstests btrfs/070. BTRFS info device nullb1: scrub: finished on devid 1 with status: 0...

PT-2024-4090

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a slab-use-after-free vulnerability in the msft do close function. This vulnerability is caused by a race condition where the msft-data is freed in hci release de...

UBUNTU-CVE-2024-26944

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free in dozonefinish Shinichiro reported the following use-after-free triggered by the device replace operation in fstests btrfs/070. BTRFS info device nullb1: scrub: finished on devid 1 with status: 0...

CVE-2024-22546

TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the dosetNTP function. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request...

TRENDnet TEW-815DAP 安全漏洞

The TRENDnet TEW-815DAP is a wireless access point from Trendnet, Inc. A security vulnerability exists in TRENDnet TEW-815DAP version 1.0.2. that originates from an easy command injection attack via the dosetNTP function...

WordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Do Minh Long Patchstack Alliance in WordPress Plugin WP Page Post Widget Clone versions = 1.0.1...