CVE-2024-50102

CVE-2024-50102 : The connected advisories indicate a Linux kernel x86 issue where using the high address bit to classify user vs. kernel space enabled a speculative-execution leak for non-canonical addresses. The root cause involves non-canonical address handling and an evolving AC/bit behavior a...

CVE-2024-50102 x86: fix user address masking non-canonical speculation issue

In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a "Meltdown Litetm" issue with non-canonical accesses in kernel space. And so using just the high bit to decide whether an access is in user...

PT-2024-39561 · WordPress · Mfolio Lite

Name of the Vulnerable Software and Affected Versions: mFolio Lite plugin for WordPress version 1.2.1 and earlier Description: The issue is due to a missing capability check, allowing authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages or upload...

WordPress WS Form LITE Plugin <= 1.9.244 is vulnerable to Cross Site Scripting (XSS)

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.244 Fixed in 1.9.245 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10647 Patch priority Medium CVSS severity Medium 7.1 Developer WS Form PSID fff125dfb47d Credits Peter Thaleikis Required...

WordPress mFolio Lite Plugin <= 1.2.1 is vulnerable to Broken Access Control

Software mFolio Lite Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9307 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 19ba5b646cd3 Credits Francesco Carlucci Required...

WordPress WP MMenu Lite plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WP MMenu Lite versions = 1.0.0...

WordPress WP MMenu Lite Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software WP MMenu Lite Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51705 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5eff0587e5b0 Credits João Pedro S Alcântara Kinorth...

CVE-2024-43932

Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.6.2...

CVE-2024-43932

Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through = 5.6.2...

CVE-2024-37214

Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5...

CVE-2024-37214

CVE-2024-37214 affects WordPress plugin AliExpress Dropshipping with AliNext Lite (Ali2Woo Lite) ≤ 3.3.5. Reported as Missing Authorization with Stored XSS due to incorrectly configured access control. PTSecurity recommends updating to a version later than 3.3.5; Wordfence and PatchStack notes co...

CVE-2024-37214 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability

Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5...

CVE-2024-37214 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability

Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5...

CVE-2024-37255 WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability

Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through = 3.1.4...

CVE-2024-38702

CVE-2024-38702 relates to Tyche Software’s Product Delivery Date for WooCommerce – Lite, describing a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs. Affected versions are Lite up to 2.7.2 (inclusive); remediation is to upgrade to a versio...

CVE-2024-43925 WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14...

CVE-2024-43932

CVE-2024-43932 is a Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite. The issue arises from incorrectly configured access control security levels, allowing unauthorized actions. Affected: The Plus Addons for Elementor Page Builder Lite up to version ...

PT-2024-28146 · Woocommerce · The Product Delivery Date For Woocommerce – Lite

Name of the Vulnerable Software and Affected Versions: Product Delivery Date for WooCommerce – Lite versions through 2.7.2 Description: The issue affects the Product Delivery Date for WooCommerce – Lite, allowing access to functionality not properly constrained by ACLs due to a Missing...

PT-2024-30793 · Unknown · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions 5.6.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

WordPress plugin Ali2Woo Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...