Incorrect Authorization

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Incorrect Authorization by exposing restricted items in the backend page tree to be viewed by other users, if the mounts pointed to pages restricted for their user/group or i...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization by exposing restricted items in the backend page tree to be viewed by other users, if the mounts pointed to pages restricted for their user/group or if permissions were set to "everybody". Remediation Upgrade...

CVE-2024-8051

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8051

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8051 Special Feed Items <= 1.0.1 - Stored XSS via CSRF

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-44162

This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items...

CVE-2024-44162

This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items...

WordPress plugin Special Feed Items 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress plugin Specia...

CVE-2024-8051: Cross-Site Request Forgery (CSRF)

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-44162

This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items...

CVE-2024-44162

This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items...

CVE-2024-44162

CVE-2024-44162 affects the Apple Xcode IDE. A malicious application could gain access to a user’s Keychain items. The issue was addressed by enabling the hardened runtime and is fixed in Xcode 16. The Red Hat/OSS feeds corroborate: impact remains local and requires the hardened runtime mitigation...

PT-2024-30977 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.1 macOS versions prior to 14.7.1 macOS versions prior to 15 Description: The issue allows an attacker with physical access to share items from the lock screen. This is possible due to inadequate checks that have...

About the security content of Xcode 16

About the security content of Xcode 16 This document describes the security content of Xcode 16. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...

CVE-2022-3459

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add...

CVE-2022-3459

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add...

DEBIAN-CVE-2024-46704

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix spruious data race in flushwork When flushing a work item for cancellation, flushwork knows that it exclusively owns the work item through its PENDING bit. 134874e2eee9 "workqueue: Allow cancelworksync and...

PT-2024-11594 · WordPress · Woocommerce Multiple Free Gift

Name of the Vulnerable Software and Affected Versions: WooCommerce Multiple Free Gift plugin for WordPress versions up to, and including, 1.2.3 Description: The issue arises from the plugin not enforcing server-side checks on the products that can be added as a gift. This allows unauthenticated...

PT-2024-32131 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A data race issue has been resolved in the Linux kernel's workqueue. The issue occurred when flushing a work item for cancellation, and the flush work function knew it exclusively owne...

GHSA-7J9P-67MM-5G87 LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability

Problem TL;DR: Any LTI tool that is integrated with on the Open edX platform can post a grade back for any LTI XBlock so long as it knows or can guess the block location for that XBlock. In LTI 1.3, LTI tools can "pass back" scores that learners earn while using LTI tools to the edX platform. The...