WordPress SMS Alert Order Notifications – WooCommerce Plugin <= 3.6.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software SMS Alert Order Notifications – WooCommerce Type Plugin Vulnerable versions = 3.6.9 Fixed in 3.7.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1489 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 78d3bccea7ab...

WordPress Orbit Fox by ThemeIsle Plugin <= 2.10.31 is vulnerable to Cross Site Scripting (XSS)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions = 2.10.31 Fixed in 2.10.32 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1323 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 18903688a247 Credits Webbernaut...

AZL-34453 CVE-2024-25629 affecting package c-ares for versions less than 1.19.1-2

c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded...

Tosibox Key Service 3.3.0 Local Privilege Escalation

Summary TOSIBOX® SoftKey is a software that enables a secure connection between your computer and one or more TOSIBOX® Nodes, giving you full visibility and control over the network devices connected to the Node. Description The application suffers from an unquoted search path issue impacting the...

CVE-2023-51389 HertzBeat SnakeYAML Deser RCE

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability...

CVE-2024-26130 cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if pkcs12.serializekeyandcertificates is called with both a certificate whose public key did not match the provided private key and an...

WordPress wpDataTables Plugin <= 3.4.2.4 is vulnerable to Cross Site Scripting (XSS)

Software wpDataTables Type Plugin Vulnerable versions = 3.4.2.4 Fixed in 3.4.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0591 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8b3b0085c333 Credits stealthcopter Required...

WordPress Cost of Goods for WooCommerce Plugin <= 3.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Cost of Goods for WooCommerce Type Plugin Vulnerable versions = 3.2.8 Fixed in 3.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0821 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 06f40e6d3a9e Credits...

WordPress Simple Job Board Plugin <= 2.10.8 is vulnerable to Broken Access Control

Software Simple Job Board Type Plugin Vulnerable versions = 2.10.8 Fixed in 2.11.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0593 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 752406ce2200 Credits Krzysztof Zając Required...

WordPress WooCommerce Google Sheet Connector Plugin <= 1.3.11 is vulnerable to Broken Access Control

Software WooCommerce Google Sheet Connector Type Plugin Vulnerable versions = 1.3.11 Fixed in 1.3.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1562 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a751d510280b Credits Francesco...

Authentication Bypass

Amendment This was deemed not a vulnerability. Overview hawk is a library for the HTTP Hawk Authentication Scheme. Affected versions of this package are vulnerable to Authentication Bypass. The incoming client supplied hash of the payload is trusted by the server and not verified before the...

Authentication Bypass

Amendment This was deemed not a vulnerability. Overview PyHawk is a Python libraries for the 'HAWK' HTTP authentication scheme Affected versions of this package are vulnerable to Authentication Bypass. The incoming client supplied hash of the payload is trusted by the server and not verified befo...

Denial of Service (DoS)

Overview images is a Cross-platform image decoderwebp/png/jpeg/gif and encoderwebp/png/jpeg for Node.js Affected versions of this package are vulnerable to Denial of Service DoS due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro...

Improper Check or Handling of Exceptional Conditions

Overview node-twain is an A TWAIN library for nodejs. Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer,...

WordPress PeproDev Ultimate Invoice Plugin <= 1.9.7 is vulnerable to Sensitive Data Exposure

Software PeproDev Ultimate Invoice Type Plugin Vulnerable versions = 1.9.7 Fixed in 1.9.8 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-25933 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 06191f6ec08b Credits Abdi Pranata...

WordPress Page scroll to id Plugin <= 1.7.8 is vulnerable to Cross Site Scripting (XSS)

Software Page scroll to id Type Plugin Vulnerable versions = 1.7.8 Fixed in 1.7.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 501f38db9d3a Credits Richard Telleng stueot...

WordPress ProfilePress Plugin <= 4.14.4 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.14.4 Fixed in 4.15.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1570 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ebc427c2e4de Credits Arkadiusz Hydzik Required...

WordPress PowerPack Addons for Elementor Plugin <= 2.7.15 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Addons for Elementor Type Plugin Vulnerable versions = 2.7.15 Fixed in 2.7.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1411 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 6ccdfffb7852 Credits wesle...

WordPress Cwicly Plugin <= 1.4.0.2 is vulnerable to Remote Code Execution (RCE)

Software Cwicly Type Plugin Vulnerable versions = 1.4.0.2 Fixed in 1.4.0.3 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-24707 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 03a26bc8d3c0 Credits Snicco Required privilege Contributo...

Command Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Command Injection through the command execution interface. An attacker can execute arbitrary commands on the server by injecting malicious inputs in...