December 2024 Security Advisory Ivanti Application Control (CVE-2024-11598)

Summary Ivanti has released updates for Ivanti Application Control which address one high severity vulnerability. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CVE Number| Description| CVSS Score Severity| CVSS Vector| CW...

December 2024 Security Advisory Ivanti Automation (CVE-2024-9845)

Summary Ivanti has released updates for Automation which addresses one high severity vulnerability. Successful exploitation could lead to local privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CVE Numbe...

Exploit for Special Element Injection in Google Android

CVE-2024-0044- CVE-2024-0044: a "run-as any app" high-severity...

CVE-2024-12053

Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...

Android Security Bulletin December 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2024-12-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

CVE-2024-7025

Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-9369

Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

WordPress Pathomation Plugin <= 2.5.1 is vulnerable to Arbitrary File Upload

Software Pathomation Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52490 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 9e87ceb4d934 Credits ghsinfosec Required privilege Unauthenticated...

CVE-2024-11395

Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress Fediverse Embeds Plugin <= 1.5.3 is vulnerable to Arbitrary File Upload

Software Fediverse Embeds Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52476 Patch priority High CVSS severity High 10 Developer Claim ownership PSID e832dcbfd87f Credits stealthcopter Required privilege...

PT-2024-34997 · Esotech · Simpul Events

Name of the Vulnerable Software and Affected Versions: Simpul Events by Esotech versions 1.8.5 and earlier Description: The issue affects Simpul Events by Esotech, allowing Stored XSS due to improper neutralization of input during web page generation. This is a high-severity XSS vulnerability...

WordPress Post Ideas Plugin <= 2 is vulnerable to SQL Injection

Software Post Ideas Type Plugin Vulnerable versions = 2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-52451 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID fe96227444bb Credits João Pedro S Alcântara Kinorth Required privilege...

WordPress de:branding Plugin <= 1.0.2 is vulnerable to Privilege Escalation

Software de:branding Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-52438 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 46e26afeaab2 Credits João Pedro S Alcântara Kinorth...

WordPress Team Rosters Plugin <= 4.6 is vulnerable to PHP Object Injection

Software Team Rosters Type Plugin Vulnerable versions = 4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52439 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 946aef8ce4ba Credits Mika Required privilege Unauthenticated Publish...

WordPress Contact Page With Google Map Plugin <= 1.6.1 is vulnerable to Arbitrary File Deletion

Software Contact Page With Google Map Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-52447 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 5441375409ba Credits Mika Required...

WordPress Uix Slideshow Plugin <= 1.6.5 is vulnerable to Arbitrary Code Execution

Software Uix Slideshow Type Plugin Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9839 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID c288369c6e6c Credits Francesco Carlucci Required privilege...

WordPress Blogger 301 Redirect Plugin <= 2.5.3 is vulnerable to SQL Injection

Software Blogger 301 Redirect Type Plugin Vulnerable versions = 2.5.3 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-10645 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 67b11c672527 Credits kr0d Required privilege Unauthenticated...

WordPress My Geo Posts Free Plugin <= 1.2 is vulnerable to PHP Object Injection

Software My Geo Posts Free Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52433 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID abf48ca2de6d Credits Mika Required privilege Unauthenticated...

WordPress WordPress Video Robot - The Ultimate Video Importer Plugin <= 1.20.0 is vulnerable to Privilege Escalation

Software WordPress Video Robot - The Ultimate Video Importer Type Plugin Vulnerable versions = 1.20.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-9192 Patch priority High CVSS severity High 8.8 Developer Claim ownership...

WordPress NIX Anti-Spam Light Plugin <= 0.0.4 is vulnerable to PHP Object Injection

Software NIX Anti-Spam Light Type Plugin Vulnerable versions = 0.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52432 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ce1317202bf3 Credits LVT-tholv2k Required privilege...