WordPress WP REST API FNS Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software WP REST API FNS Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49329 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 82dff35973b2 Credits stealthcopter Required privilege...

WordPress Affiliator Plugin <= 2.1.3 is vulnerable to Arbitrary File Upload

Software Affiliator Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49326 Patch priority High CVSS severity High 10 Developer Claim ownership PSID bed59e49a030 Credits João Pedro S Alcântara Kinorth Required privile...

WordPress Nice Backgrounds Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software Nice Backgrounds Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49330 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 33cca7eeaf15 Credits stealthcopter Required privilege Subscriber...

WordPress Sovratec Case Management Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Sovratec Case Management Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49324 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 36d5eac9e669 Credits stealthcopter Required privilege...

CVE-2024-9954

Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress JiangQie Free Mini Program Plugin <= 2.5.2 is vulnerable to Arbitrary File Upload

Software JiangQie Free Mini Program Type Plugin Vulnerable versions = 2.5.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49314 Patch priority High CVSS severity High 10 Developer Claim ownership PSID be9e9805193d Credits stealthcopter Required privileg...

WordPress SSV Events Plugin <= 3.2.7 is vulnerable to Local File Inclusion

Software SSV Events Type Plugin Vulnerable versions = 3.2.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49286 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID ad40e495904a Credits tahu.datar Required privilege Unauthenticated...

WordPress PDF-Rechnungsverwaltung Plugin <= 0.0.1 is vulnerable to Local File Inclusion

Software PDF-Rechnungsverwaltung Type Plugin Vulnerable versions = 0.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49287 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID e30e75b2fb5a Credits tahu.datar Required privilege...

WordPress Ahime Image Printer Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Ahime Image Printer Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-49245 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 4330a07d13a8 Credits stealthcopter Required...

WordPress Analyse Uploads Plugin <= 0.5 is vulnerable to Arbitrary File Deletion

Software Analyse Uploads Type Plugin Vulnerable versions = 0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49253 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 7d31a27cc3f2 Credits stealthcopter Required privilege...

WordPress ajax-extend Plugin <= 1.0 is vulnerable to Remote Code Execution (RCE)

Software ajax-extend Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-49254 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 52c87350742c Credits stealthcopter Required privilege...

SUSE CVE-2024-9602

Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

PT-2024-25347 · Lenovo · Lenovo Baiying

Name of the Vulnerable Software and Affected Versions: Lenovo Baiying affected versions not specified Description: A DLL hijack issue was reported that could allow a local attacker to execute code with elevated privileges. The issue affects Lenovo products and has a high severity level...

WordPress GutenKit Plugin <= 2.1.0 is vulnerable to Arbitrary File Upload

Software GutenKit Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9234 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 084e0f3075d0 Credits Sean Murphy Required privilege Unauthenticated...

WordPress Creates 3D Flipbook, PDF Flipbook Plugin <= 1.2 is vulnerable to Arbitrary File Upload

Software Creates 3D Flipbook, PDF Flipbook Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-48034 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID f79a1953acf9 Credits stealthcopter Required...

PT-2024-31952 · Sparkshop · Sparkshop

Name of the Vulnerable Software and Affected Versions: Sparkshop version 1.16 Description: A loop hole in the payment logic of Sparkshop allows attackers to arbitrarily modify the number of products. This is a high-severity issue that affects multiple versions of Sparkshop. Users are urged to...

CVE-2024-9602

Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

Bundled JRE Dependency in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.9.0, 8.19.0, and 9.2.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to expose assets in your environment susceptible...

PT-2024-7216 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.100 Description: The issue is related to a type confusion in the V8 component of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The...

Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2024-7612) 

Summary: Ivanti has released updates for Ivanti EPMM which addresses a high severity vulnerability. Successful exploitation could lead to an authenticated attacker accessing or modifying configuration files. We are not aware of any customers being exploited by these vulnerabilities at the time of...