CVE-2024-5843

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. Chromium security severity: Medium...

CVE-2024-5843

CVE-2024-5843 affects Google Chrome/Chromium: an Inappropriate implementation in Downloads allowed a remote attacker to obfuscate the security UI via a malicious file. The Chrome release notes for 126.x document this as one of 21 fixes, with CVE-2024-5843 listed among Medium/High-severity issues ...

CVE-2024-5813 SSH Private Key Leak in BeyondInsight PasswordSafe

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

WordPress CF7 Google Sheets Connector Plugin <= 5.0.9 is vulnerable to Broken Access Control

Software CF7 Google Sheets Connector Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5654 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 90b82cd51794 Credits 1337Wannabe...

WordPress Minimal Coming Soon & Maintenance Mode – Coming Soon Page Plugin <= 2.38 is vulnerable to Broken Access Control

Software Minimal Coming Soon & Maintenance Mode – Coming Soon Page Type Plugin Vulnerable versions = 2.38 Fixed in 2.39 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5087 Patch priority Medium CVSS severity Medium 6.3 Developer WebFactory Ltd. PSID...

WordPress Formula Theme <= 0.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Formula Type Theme Vulnerable versions = 0.5.1 Fixed in 0.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5638 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3a71d72e8ae6 Credits blackmoon Required privileg...

WordPress Photo Gallery by 10Web Plugin <= 1.8.23 is vulnerable to Path Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.23 Fixed in 1.8.24 OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2024-5481 Patch priority Medium CVSS severity Medium 6.8 Developer Claim ownership PSID f9ab0048fc76 Credits Tobias Weißhaar kun19 Required...

WordPress Copymatic – AI Content Writer & Generator Plugin <= 1.9 is vulnerable to Broken Access Control

Software Copymatic – AI Content Writer & Generator Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35716 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID acafd07bdb00 Credits...

WordPress Widget Options Plugin <= 4.0.1 is vulnerable to Sensitive Data Exposure

Software Widget Options Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-35690 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d20ab85a5efb Credits Dave Jong Patchstack...

WordPress WP Docs Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Docs Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35696 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0c51b0b8b213 Credits LVT-tholv2k Required privilege...

WordPress GiveWP Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software GiveWP Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.12.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35679 Patch priority Medium CVSS severity Medium 7.1 Developer Liquid Web / StellarWP PSID f4b075a69f03 Credits Dimas Maulana Required privilege...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress Event Tickets with Ticket Scanner Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Event Tickets with Ticket Scanner Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35652 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a8b7482ae90c Credits Le Ngoc Anh...

NULL pointer dereference in HTTP/3

NULL pointer dereference in HTTP/3 Severity: medium CVE-2024-35200 Not vulnerable: 1.27.0+, 1.26.1+ Vulnerable: 1.25.0-1.25.5, 1.26.0...

WordPress Swiss Toolkit For WP Plugin <= 1.0.7 is vulnerable to Broken Authentication

Software Swiss Toolkit For WP Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-5204 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 07e08699642a Credits István Márton...

WordPress WPCafe Plugin <= 2.2.23 is vulnerable to Server Side Request Forgery (SSRF)

Software WPCafe Type Plugin Vulnerable versions = 2.2.23 Fixed in 2.2.24 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-1855 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID ae70d23ac201 Credits Lucio Sá Required privilege...

QNAP Patches New Flaws in QTS and QuTS hero Impacting NAS Appliances

Taiwanese company QNAP has rolled out fixes for a set of medium-severity flaws impacting QTS and QuTS hero, some of which could be exploited to achieve code execution on its network-attached storage NAS appliances. The issues, which impact QTS 5.1.x and QuTS hero h5.1.x, are listed below -...

WordPress LuckyWP Table of Contents Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2119 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fd6e9deb644b Credits Lucio Sá...

WordPress Sailthru Triggermail Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Sailthru Triggermail Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4289 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7b53f4a9625e Credits Bob Matyas Requir...

WordPress ShopLentor Plugin <= 2.8.8 is vulnerable to Broken Access Control

Software ShopLentor Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.8.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4566 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce982ce5a6fa Credits TheGreatLol Required privileg...