CVE-2024-22461

Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of complete system...

CVE-2024-22461

Dell RecoverPoint for Virtual Machines 6.0.x contains an OS command injection vulnerability due to improper input validation. A low-privilege remote attacker could execute arbitrary commands as root, potentially compromising the entire system. Mitigation: apply Dell security update referenced as ...

CVE-2024-11827 Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode

The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootbquery shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11754

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11767

CVE-2024-11767 affects the NewsmanApp WordPress plugin. The vulnerability is a Stored Cross-Site Scripting in the plugin’s newsman_subscribe_widget shortcode, present in all versions up to 2.7.6. Exploitation requires authenticated access at contributor level or higher, allowing an attacker to in...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50208)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50208 advisory. - In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a bug while setting up...

PT-2024-17606 · WordPress · Property Hive Stamp Duty Calculator

Name of the Vulnerable Software and Affected Versions: Property Hive Stamp Duty Calculator plugin for WordPress versions up to, and including, 1.0.22 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stamp duty calculator scotland' shortcode due to insufficient...

openSUSE Security Advisory (SUSE-SU-2024:4306-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

...

pinctrl: ocelot: fix system hang on level based interrupts

...

CVE-2024-12329

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-11724

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

CVE-2024-12201

CVE-2024-12201 relates to the WordPress plugin Hash Form – Drag & Drop Form Builder . It is described as vulnerable in all versions up to 1.2.1 due to a missing capability check during creation of form styles, enabling authenticated attackers with Contributor-level access and above to create new ...

CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

CVE-2024-10583 Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘posttitle’ parameter in all versions up to, and including, 1.20.2 due to insufficient input sanitization and output...

CVE-2024-11181 Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wpreusablerender' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticate...

CVE-2024-11765

The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsportfolio' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization a...

CVE-2024-11785

CVE-2024-11785 (Integrate Firebase, WordPress) stores cross-site scripting in the Firebase integration plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s firebase_show shortcode, affecting all version...

CVE-2024-11871

CVE-2024-11871 is a stored XSS vulnerability in the WordPress plugin Social Media Shortcodes (versions up to 1.3.0) via the plugin’s patreon shortcode. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing an authenticated attacker with co...

CVE-2024-12018

CVE-2024-12018 affects the WordPress plugin Snippet Shortcodes (Snippet Shortcodes). The issue is an unauthorized Shortcode Deletion vulnerability due to leaked nonce authentication in all versions up to 4.1.6, enabling authenticated attackers with Subscriber+ privileges to delete Shortcodes. Con...