CVE-2021-4438

CVE-2021-4438 affects kyivstarteam/react-native-sms-user-consent up to 1.1.4 on Android. The issue lies in SmsUserConsentModule.kt, registerReceiver, causing improper export of Android components. Local attack is required. Upgrading to version 1.1.5 fixes the vulnerability (patch: 5423dcb0cd3e4d5...

CVE-2021-4438

A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The...

WordPress Plugin LearnPress: SQL Injection Vulnerability in Export/Import Functionality

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin LearnPress Export Import suffers from...

PT-2024-11036

Name of the Vulnerable Software and Affected Versions kyivstarteam react-native-sms-user-consent versions 1.1.4 and earlier Description A critical issue has been found in the affected software, specifically in the function registerReceiver of the file...

PT-2024-23956 · WordPress · Wp Import Export Lite

Name of the Vulnerable Software and Affected Versions: WP Import Export Lite versions 3.9.26 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks. Recommendations: For WP Import Export Lite versions 3.9.26 and earlier,...

React Native Sms User Consent security vulnerability

React Native Sms User Consent is an open source library by Kyivstar Tech Digital. A security vulnerability exists in React Native Sms User Consent 1.1.4 and earlier versions, which stems from a security issue in the registerReceiver function in...

CVE-2024-31241: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3...

CVE-2024-31308: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26...

WordPress Plugin WP Import Export Lite: Code Issues and Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-23883 · Thimpress · Thimpress Learnpress Export Import

Name of the Vulnerable Software and Affected Versions: ThimPress LearnPress Export Import versions n/a through 4.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitatio...

CVE-2021-4438: Improper Export of Android Application Components

A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The...

blind-rsa-signatures (0.9.0), jwt-simple (>=0.2.7, <=0.9.3) +1 more potentially affected by unknown CVE via rsa-export (0.3.3)

rsa-export CARGO version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on rsa-export and may be impacted: - blind-rsa-signatures 0.9.0 - jwt-simple =0.2.7, =0.1.2, =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0333...

`rsa-export` is unmaintained

This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See docs.rs documentation. In addition to that, the operations in this crate arithmetic and Base64 encoding are not done in constant-time, potentially exposing the user to...

WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Trình Vũ / Sonicrrrr from VNPT-VCI Patchstack Alliance in WordPress Plugin WP Import Export Lite versions = 3.9.26...

WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Products, Order & Customers Export for WooCommerce versions = 2.0.8...

WordPress Advanced Order Export For WooCommerce plugin <= 3.4.4 - Remote Code Execution vulnerability

Remote Code Execution vulnerability discovered by movrment Patchstack Alliance in WordPress Plugin Advanced Order Export For WooCommerce versions = 3.4.4...

WordPress LearnPress Export Import plugin <= 4.0.3 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin LearnPress Export Import versions = 4.0.3...

WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WordPress Comments Import & Export versions = 2.3.5...

WordPress LearnPress Export Import Plugin <= 4.0.3 is vulnerable to SQL Injection

Software LearnPress Export Import Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.0.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-31241 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 0bd547fb213e Credits Le Ngoc Anh Required privilege...

WordPress WP Import Export Lite Plugin <= 3.9.26 is vulnerable to PHP Object Injection

Software WP Import Export Lite Type Plugin Vulnerable versions = 3.9.26 Fixed in 3.9.27 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-31308 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 6bc80ca274a7 Credits Trình Vũ Sonicrrrr from VNPT-VCI...