WordPress WPCafe Plugin <= 2.2.23 is vulnerable to Server Side Request Forgery (SSRF)

Software WPCafe Type Plugin Vulnerable versions = 2.2.23 Fixed in 2.2.24 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-1855 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID ae70d23ac201 Credits Lucio Sá Required privilege...

QNAP Patches New Flaws in QTS and QuTS hero Impacting NAS Appliances

Taiwanese company QNAP has rolled out fixes for a set of medium-severity flaws impacting QTS and QuTS hero, some of which could be exploited to achieve code execution on its network-attached storage NAS appliances. The issues, which impact QTS 5.1.x and QuTS hero h5.1.x, are listed below -...

WordPress LuckyWP Table of Contents Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2119 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fd6e9deb644b Credits Lucio Sá...

WordPress ShopLentor Plugin <= 2.8.8 is vulnerable to Broken Access Control

Software ShopLentor Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.8.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4566 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce982ce5a6fa Credits TheGreatLol Required privileg...

WordPress Sailthru Triggermail Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Sailthru Triggermail Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4289 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7b53f4a9625e Credits Bob Matyas Requir...

verbb/formie Server-Side Template Injection for variable-enabled settings

Impact Users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This is listed as low-medium severity due to...

WordPress Popup Maker WP Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker WP Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34770 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7bf55dc1ca78 Credits Rayhan Ramdhany Hanaputra Require...

WordPress Cost Calculator Builder Pro Plugin <= 3.1.72 is vulnerable to Server Side Request Forgery (SSRF)

Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.72 Fixed in 3.1.73 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-4789 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID eba410ca734c Credits haidv35...

GHSA-39J2-4P9J-5W4J Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

CVE-2024-4949

Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-4949

CVE-2024-4949 affects Chromium-based Chrome builds due to a use-after-free in V8 prior to 125.0.6422.60, enabling potential heap corruption via a crafted HTML page. Connected advisories (Debian, Fedora, CHAINGUARD CGR, and vendor advisories) confirm this CVE and indicate updates to Chromium 125.0...

Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

GHSA-63G3-9JQ3-MCCV Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

Grafana proxy Cross-site Scripting

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5.15 -...

Intel Chipset Device Software Advisory - Lenovo Support US

No description provided...

Intel Ethernet Controller Administrative Tools Installer Software Advisory - Lenovo Support US

No description provided...

WordPress Simple Basic Contact Form Plugin <= 20240502 is vulnerable to Broken Access Control

Software Simple Basic Contact Form Type Plugin Vulnerable versions = 20240502 Fixed in 20240511 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4144 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e272f8f841f7 Credits...

WordPress WP Compress – Image Optimizer [All-In-One] Plugin <= 6.20.01 is vulnerable to Broken Access Control

Software WP Compress – Image Optimizer All-In-One Type Plugin Vulnerable versions = 6.20.01 Fixed in 6.20.02 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4445 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fbb504f543bf...

WordPress Landing Page Builder Plugin <= 1.5.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Landing Page Builder Type Plugin Vulnerable versions = 1.5.1.8 Fixed in 1.5.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34752 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d84e812a046a Credits Dimas Maulana Required...