5930 matches found
CVE-2024-6232 Regular-expression DoS when parsing TarFile headers
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...
WordPress Attire Theme <= 2.0.6 is vulnerable to PHP Object Injection
Software Attire Type Theme Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7435 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 834924dbc4f2 Credits Francesco Carlucci Required privilege Contribut...
WordPress Blogpoet Theme <= 1.0.3 is vulnerable to Broken Access Control
Software Blogpoet Type Theme Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43998 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 863978478910 Credits Fariq Fadillah Gusti Insani...
WordPress ReviveNews Theme <= 1.0.2 is vulnerable to Broken Access Control
Software ReviveNews Type Theme Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43974 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 47fb9a9aedf3 Credits Fariq Fadillah Gusti Insani...
WordPress Blockbooster Theme <= 1.0.10 is vulnerable to Broken Access Control
Software Blockbooster Type Theme Vulnerable versions = 1.0.10 Fixed in 1.0.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43979 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fac761fd31ce Credits Fariq Fadillah Gusti Insa...
WordPress Music Request Manager Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Software Music Request Manager Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6018 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 864294ddb006 Credits Bob Matyas...
WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.6.1 is vulnerable to Cross Site Scripting (XSS)
Software YellowPencil Visual CSS Style Editor Type Plugin Vulnerable versions = 7.6.1 Fixed in 7.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43963 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8ac87b1f76e Credits Le Ngoc Anh...
WordPress Simple Job Board Plugin <= 2.12.3 is vulnerable to PHP Object Injection
Software Simple Job Board Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.12.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7351 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a1947bfcfa95 Credits Francesco Carlucci Required privileg...
WordPress Testimonials Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)
Software Testimonials Type Plugin Vulnerable versions = 4.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43959 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8da344adddf2 Credits Abdi Pranata Required privilege...
WordPress Magic Post Thumbnail Plugin <= 5.2.9 is vulnerable to Cross Site Scripting (XSS)
Software Magic Post Thumbnail Type Plugin Vulnerable versions = 5.2.9 Fixed in 5.2.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43921 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID df0d3514c8f0 Credits Le Ngoc Anh Required...
WordPress Brickscore Plugin <= 1.4.2.5 is vulnerable to Cross Site Scripting (XSS)
Software Brickscore Type Plugin Vulnerable versions = 1.4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43950 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 72067279088d Credits Dave Jong Patchstack Required privile...
GitHub Patches Critical Security Flaw in Enterprise Server Granting Admin Privileges
GitHub has released fixes to address a set of three security flaws impacting its Enterprise Server product, including one critical bug that could be abused to gain site administrator privileges. The most severe of the shortcomings has been assigned the CVE identifier CVE-2024-6800, and carries a...
DEBIAN-CVE-2024-7974
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...
CVE-2024-7972
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...
CVE-2024-7977
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. Chromium security severity: Medium...
CVE-2024-7975
Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
CVE-2024-7973
Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. Chromium security severity: Medium...
CVE-2024-7975
Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
CVE-2024-7976
CVE-2024-7976 relates to Google Chrome/Chromium FedCM, where an Inappropriate implementation flaw in FedCM prior to 128.0.6613.84 could allow a remote attacker to spoof the UI via a crafted HTML page. The CVE is documented as a Medium-severity issue with network attack vector, low integrity impac...
