WordPress XStore Theme <= 9.3.8 is vulnerable to Cross Site Scripting (XSS)

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33562 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d1626b7824f Credits Rafie Muhammad Patchstack Required privile...

WordPress Sticky Anything Plugin <= 2.1.5 is vulnerable to Broken Access Control

Software Sticky Anything Type Plugin Vulnerable versions = 2.1.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33646 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID da01f8f0e18d Credits Dimas Maulana Required...

WordPress UDesign Theme <= 4.7.3 is vulnerable to Cross Site Scripting (XSS)

Software UDesign Type Theme Vulnerable versions = 4.7.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4077 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b5fe2949f69d Credits Rafie Muhammad Patchstack Required privilege...

freerdp:TestFuzzFastpath: Heap-buffer-overflow in rdp_read_capability_sets

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5149800723972096 Project: freerdp Fuzzing Engine: libFuzzer Fuzz Target: TestFuzzFastpath Job Type: libfuzzerasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

ndpi:fuzz_alg_shoco: Stack-buffer-overflow in shoco_decompress

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4947794864439296 Project: ndpi Fuzzing Engine: honggfuzz Fuzz Target: fuzzalgshoco Job Type: honggfuzzasanndpi Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7ffeb47a0c60 Cra...

WordPress Social Snap Plugin <= 1.3.5 is vulnerable to Broken Access Control

Software Social Snap Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32805 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4bb46049199a Credits Majed Refaea Required...

WordPress ARForms Plugin <= 6.4 is vulnerable to Settings Change

Software ARForms Type Plugin Vulnerable versions = 6.4 Fixed in 6.4.1 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-32704 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bcff8bbe359f Credits Dave Jong Patchstack Required privilege...

WordPress RomethemeForm For Elementor Plugin <= 1.1.2 is vulnerable to Broken Access Control

Software RomethemeForm For Elementor Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32727 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID cdacd7b1b9f1 Credits thiennv...

WordPress Integrate Google Drive Plugin <= 1.3.8 is vulnerable to Broken Access Control

Software Integrate Google Drive Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.91 OWASP Top 10 A4: Insecure Design Classification Broken Access Control CVE CVE-2024-32949 Patch priority Medium CVSS severity Medium 8.3 Developer Claim ownership PSID ccf771b656bb Credits Steven Julian Require...

WordPress ARForms Plugin <= 6.4 is vulnerable to Cross Site Scripting (XSS)

Software ARForms Type Plugin Vulnerable versions = 6.4 Fixed in 6.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32702 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2ac8f7cc23af Credits Dave Jong Patchstack Required privilege...

fwupd:uswid_fuzzer: Heap-buffer-overflow in cbor_array_get

Project: https://github.com/fwupd/fwupd.git Detailed Report: https://oss-fuzz.com/testcase?key=5146455019945984 Project: fwupd Fuzzing Engine: libFuzzer Fuzz Target: uswidfuzzer Job Type: libfuzzerasanfwupd Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x602000001418...

WordPress Poll Maker Plugin <= 5.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Poll Maker Type Plugin Vulnerable versions = 5.1.8 Fixed in 5.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3600 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bd489978d30b Credits Krzysztof Zając Require...

SUSE CVE-2024-3840

Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3839

Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2024-3838

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...

CVE-2024-3838

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...

CVE-2024-3839

Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3840

Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3840

CVE-2024-3840 affects Google Chrome/Chromium where insufficient policy enforcement in Site Isolation could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is mitigated in Chrome/Chromium 124.0.6367.60 (and newer); Debian security advisory lists 124.0.6...

CVE-2024-3838

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...