CVE-2024-7514 WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access an...

CVE-2024-7514: Improper Limitation of a Pathname to a Restricted Directory

The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access an...

PT-2024-38402

Name of the Vulnerable Software and Affected Versions WordPress Comments Import & Export plugin versions up to and including 2.3.7 Description The issue is related to insufficient file path validation during the comments import process, allowing authenticated attackers with Author-level access an...

WordPress Plugin: Comments Import & Export – Path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exists...

WordPress WordPress Comments Import & Export plugin <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal vulnerability

Authenticated Author+ Arbitrary File Read via Directory Traversal vulnerability discovered by scottaglia in WordPress Plugin Comments Import & Export versions = 2.3.7...

CVE-2024-9377

The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticat...

CVE-2024-9377: Improper Neutralization of Input During Web Page Generation

The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticat...

WordPress plugin: Products, Order & Customers Export for WooCommerce – Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.15 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Products, Order & Customers Export for WooCommerce versions = 2.0.15...

PT-2024-9690 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform affected versions not specified Description: The issue is related to improper authorization checks, allowing an authenticated attacker to gain higher access levels than they should...

Apple macOS security vulnerabilities

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS version 13.7, which stems from a shortcut that may export sensitive user data without consent...

WPS Office Spreadsheet Module Arbitrary Command Execution

The vulnerability of the MHTML export function in the Spreadsheet module of the WPS Office office software on Windows operating systems is related to the loading of malicious DLL libraries due to an incorrect limitation on the path to the ksoqing directory. Exploiting this vulnerability allows a...

PT-2024-38661

Name of the Vulnerable Software and Affected Versions The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress versions up to, and including, 3.1.7 Description The issue is related to unauthorized access due to a missing capability check on several functions,...

CVE-2024-27113

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

CVE-2024-27113: Exposure of Sensitive Information to an Unauthorized Actor

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

PT-2024-21655

Name of the Vulnerable Software and Affected Versions SO Planning tool versions prior to 1.52.02 Description An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use...

SOPlanning security vulnerabilities

SOPlanning is a suite of online project management software from SOPlanning. A security vulnerability exists in SOPlanning. An attacker exploiting the vulnerability could access the underlying database by exporting it as a CSV file...

BIT-NODE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...