Whoogle Search Server-Side Request Forgery vulnerability

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...

AZL-36895 CVE-2024-28849 affecting package reaper for versions less than 3.1.1-9

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...

WordPress EventPrime Plugin <= 3.4.1 is vulnerable to Broken Access Control

Software EventPrime Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1126 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f1030a0eaeb5 Credits Lucio Sá Required privilege...

WordPress Categorify Plugin <= 1.0.7.4 is vulnerable to Broken Access Control

Software Categorify Type Plugin Vulnerable versions = 1.0.7.4 Fixed in 1.0.7.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1649 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ae42a7532dc2 Credits Francesco Carlucci Required...

WordPress Accordion Plugin <= 2.2.96 is vulnerable to Broken Access Control

Software Accordion Type Plugin Vulnerable versions = 2.2.96 Fixed in 2.2.97 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1641 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0c15c521aa36 Credits Lucio Sá Required privilege...

WordPress HT Mega Plugin <= 2.4.6 is vulnerable to Directory Traversal

Software HT Mega Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A5: Broken Access Control Classification Directory Traversal CVE CVE-2024-1974 Patch priority Low CVSS severity Low 7.7 Developer HTMega PSID 6d7e2f2731f2 Credits Webbernaut Required privilege Contributor Publish...

Information Exposure Vulnerability in Cosminexus Component Container

Overview An information exposure vulnerability CVE-2023-6814 exists in Cosminexus Component Container. Affected products and versions are listed below. Please upgrade your version to the appropriate version. These vulnerabilities exist in Cosminexus Component Container which is a component produc...

WordPress Contact Form 7 Plugin <= 5.9 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Type Plugin Vulnerable versions = 5.9 Fixed in 5.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2242 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d34f7907f9a Credits Asaf Mozes Required...

WordPress AntiSpam for Contact Form 7 Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)

Software AntiSpam for Contact Form 7 Type Plugin Vulnerable versions = 0.6.0 Fixed in 0.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27961 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f9498b94e6d4 Credits stealthcopter Required...

WordPress Quiz And Survey Master Plugin <= 8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27966 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b39b4217a315 Credits Marzieh Hashemi Required...

WordPress Visualizer Plugin <= 3.10.5 is vulnerable to Cross Site Scripting (XSS)

Software Visualizer Type Plugin Vulnerable versions = 3.10.5 Fixed in 3.10.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27958 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID c3450277a0c7 Credits stealthcopter Required privilege...

WordPress Prime Slider – Addons For Elementor Plugin <= 3.13.2 is vulnerable to Cross Site Scripting (XSS)

Software Prime Slider – Addons For Elementor Type Plugin Vulnerable versions = 3.13.2 Fixed in 3.13.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1508 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f2721cd17ac Credits...

WordPress Team Circle Image Slider With Lightbox Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Team Circle Image Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2015-10130 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4e4875511ed9 Credit...

WordPress Web Application Firewall – website security Plugin <= 2.1.1 is vulnerable to Privilege Escalation

Software Web Application Firewall – website security Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-2172 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 079a85617a7b Credits...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-27953 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 036319de798f...

WordPress Related Posts for WordPress Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Related Posts for WordPress Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0592 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89e5ec281512 Credits Krzyszto...

WordPress Shariff Wrapper Plugin <= 4.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions = 4.6.9 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0966 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32b0d6ace355 Credits Muhammad Daffa Required...

WordPress Starbox Plugin < 3.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Starbox Type Plugin Vulnerable versions 3.5.0 Fixed in 3.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1273 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 23b6dbb093c5 Credits Dmitrii Ignatyev Required privileg...

PT-2024-2304 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 13.0.5, 14.0.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability in the memory, which could allow an attacker to execute arbitrary code in the context of the current user. Exploitation...

WordPress Shariff Wrapper Plugin <= 4.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions = 4.6.9 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6500 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 66d31de1e026 Credits Rafshanzani Suhada...