CVE-2024-9609: Improper Neutralization of Input During Web Page Generation

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

WordPress LearnPress Export Import plugin <= 4.0.4 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin LearnPress Export Import versions = 4.0.4...

WordPress LearnPress Export Import Plugin <= 4.0.4 is vulnerable to Cross Site Scripting (XSS)

Software LearnPress Export Import Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9609 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 496adf4dad4b Credits vgo0...

MAL-2024-10666 Malicious code in export-pruner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e2f312ed9fbfa3af3855f0f17ba52946628c78e0176ec0f9c5a7ed8f2ce8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in export-pruner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e2f312ed9fbfa3af3855f0f17ba52946628c78e0176ec0f9c5a7ed8f2ce8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10828

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for...

CVE-2024-10828 Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for...

CVE-2024-10852 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buyoneclickexportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-10828: Deserialization of Untrusted Data

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for...

CVE-2024-10852: Missing Authorization

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buyoneclickexportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level acce...

WordPress plugin “Advanced Order Export for WooCommerce” – Code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

WordPress plugin “Buy One Click WooCommerce” has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

PT-2024-16591 · WordPress · Buy One Click Woocommerce Plugin

Name of the Vulnerable Software and Affected Versions: Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description: The issue arises from a missing capability check on the buy one click export options AJAX action, allowing authenticated attackers with...

WordPress Advanced Order Export For WooCommerce plugin <= 3.5.5 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin Advanced Order Export For WooCommerce versions = 3.5.5...

CLSA-2024-1731432106 ImageMagick: Fix of 2 CVEs

CVE-2020-27751: fix undefined behavior due to an overly large shift exponent in quantum-export.c - CVE-2020-27768: fix NaN being outside the range of representable values issue in quantum-private.h...

WordPress Buy one click WooCommerce plugin <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Export vulnerability discovered by incognito in WordPress Plugin Buy one click WooCommerce versions = 2.2.9...

kernel: tick/nohz: unexport __init-annotated tick_nohz_full_setup()

In the Linux kernel, the following vulnerability has been resolved: tick/nohz: unexport init-annotated ticknohzfullsetup EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The access to ...

PT-2024-16575

Name of the Vulnerable Software and Affected Versions Advanced Order Export For WooCommerce plugin for WordPress versions up to, and including, 3.5.5 Description The issue concerns PHP Object Injection via deserialization of untrusted input during Order export when the Try to convert serialized...

PT-2024-34522 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 7.0.13 build 15514 Description: The issue allows a low-privileged attacker to modify their profile name and inject a malicious payload into the Name field. When an administrator later accesses the People Management page,...

CVE-2024-51094

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be...