WordPress Parallax Image Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Parallax Image Type Plugin Vulnerable versions = 1.8 Fixed in 1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9898 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 90e7358f506d Credits Peter Thaleikis Required...

PT-2024-33390 · Leyka · Leyka

Name of the Vulnerable Software and Affected Versions: Leyka versions prior to 3.31.6 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This is a problem where sensitive information is accessible to unauthorized parties, potential...

Qnap QTS Out-of-bounds Write (CVE-2021-34343)

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS...

WordPress PublishPress Authors Plugin <= 4.7.1 is vulnerable to Privilege Escalation

Software PublishPress Authors Type Plugin Vulnerable versions = 4.7.1 Fixed in 4.7.2 OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-9215 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID dc9bff13d8f2 Credits wesley wcraft Required...

WordPress Royal Elementor Addons Plugin <= 1.3.986 is vulnerable to Sensitive Data Exposure

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.986 Fixed in 1.3.987 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-7417 Patch priority Low CVSS severity Low 4.3 Developer WProyal PSID 4060f71c187f Credits stealthcopter Required...

Qnap QTS OS Command Injection (CVE-2023-41283)

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596...

WordPress WP VR Plugin <= 8.5.4 is vulnerable to Broken Access Control

Software WP VR Type Plugin Vulnerable versions = 8.5.4 Fixed in 8.5.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49293 Patch priority Low CVSS severity Low 4.3 Developer WPFunnels Team PSID ece40c2ceb73 Credits Trương Hữu Phúc truonghuuphuc Required...

WordPress Smart Online Order for Clover Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Smart Online Order for Clover Type Plugin Vulnerable versions = 1.5.7 Fixed in 1.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9895 Patch priority Low CVSS severity Low 6.5 Developer Zaytech PSID 130bf1a9af2d Credits Peter Thaleikis...

WordPress ElementInvader Addons for Elementor Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software ElementInvader Addons for Elementor Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2293b37c11ea Credits Coli...

WordPress AADMY Plugin <= 2.0.1 is vulnerable to Content Injection

Software AADMY Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9837 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e1df1286c7c4 Credits Francesco Carlucci Required privilege...

WordPress Elementor Website Builder Plugin <= 3.24.5 is vulnerable to Sensitive Data Exposure

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.24.5 Fixed in 3.24.6 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-6757 Patch priority Low CVSS severity Low 4.3 Developer Elementor PSID f4cfefcf22b1 Credits stealthcopter Required...

WordPress TablePress Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)

Software TablePress Type Plugin Vulnerable versions = 2.4.2 Fixed in 2.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9595 Patch priority Low CVSS severity Low 5.9 Developer TablePress PSID e1ecd7cf1ef2 Credits Max Boll b0lli Required privilege...

WordPress WordPress File Upload Plugin <= 4.24.11 is vulnerable to Path Traversal

Software WordPress File Upload Type Plugin Vulnerable versions = 4.24.11 Fixed in 4.24.12 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-9047 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5fa6436aa19c Credits Arkadiusz Hydzik Required...

CVE-2024-7099

The CVE-2024-7099 issue affects netease-youdao/qanything, vulnerable in version 1.4.1 where unsafe data from user input is concatenated into SQL queries. Functions such as get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status are implicated, enabling an attacker to ...

WordPress Happy Addons for Elementor Plugin <= 3.12.3 is vulnerable to Broken Access Control

Software Happy Addons for Elementor Type Plugin Vulnerable versions = 3.12.3 Fixed in 3.12.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-48045 Patch priority Low CVSS severity Low 4.3 Developer Leevio PSID 12a67710b428 Credits Rafie Muhammad Patchstack...

WordPress ShortPixel Image Optimizer Plugin <= 5.6.3 is vulnerable to Broken Access Control

Software ShortPixel Image Optimizer Type Plugin Vulnerable versions = 5.6.3 Fixed in 5.6.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-48044 Patch priority Low CVSS severity Low 5.4 Developer ShortPixel PSID a501abcf0465 Credits Rafie Muhammad Patchsta...

WordPress WordPress Comments Import & Export Plugin <= 2.3.7 is vulnerable to Directory Traversal

Software WordPress Comments Import & Export Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.9 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-7514 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 06055d28d8b6 Credits scottaglia Required...

WordPress Tainacan Plugin <= 0.21.10 is vulnerable to Cross Site Scripting (XSS)

Software Tainacan Type Plugin Vulnerable versions = 0.21.10 Fixed in 0.21.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9221 Patch priority Medium CVSS severity Medium 7.1 Developer Tainacan Community PSID 3d12acf57920 Credits Colin Xu Required...

WordPress Advanced Custom Fields PRO Plugin <= 6.3.7 is vulnerable to Arbitrary Code Execution

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions = 6.3.7 Fixed in 6.3.8 OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9529 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID aa150d72013d Credits Automattic Security Team...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.win-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code execution...