WordPress Razorpay Payment Button Elementor Plugin Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Razorpay Payment Button Elementor Plugin Type Plugin Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10850 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6e305704fc07...

CVE-2024-47808: Incorrect Permission Assignment for Critical Resource

A vulnerability has been identified in SINEC NMS All versions V3.0 SP1. The affected application contains a database function, that does not properly restrict the permissions of users to write to the filesystem of the host system. This could allow an authenticated medium-privileged attacker to...

WordPress Constant Contact Forms by MailMunch Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Constant Contact Forms by MailMunch Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9614 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 53dd5edc8197 Credits...

WordPress xili-tidy-tags Plugin <= 1.12.04 is vulnerable to Cross Site Scripting (XSS)

Software xili-tidy-tags Type Plugin Vulnerable versions = 1.12.04 Fixed in 1.12.05 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9357 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b09fba83740 Credits vgo0 Required...

WordPress WOLF Plugin <= 1.0.8.3 is vulnerable to Path Traversal

Software WOLF Type Plugin Vulnerable versions = 1.0.8.3 Fixed in 1.0.8.4 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-52396 Patch priority Medium CVSS severity Medium 4.9 Developer Claim ownership PSID 1a1949b4101b Credits Trương Hữu Phúc truonghuuphuc Require...

WordPress WP Job Portal Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Job Portal Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52389 Patch priority Medium CVSS severity Medium 6.5 Developer Ahmad PSID 3e42293c0184 Credits casol Required privilege Subscriber Publishe...

WordPress WP Photo Album Plus Plugin <= 8.8.08.007 is vulnerable to Broken Access Control

Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.8.08.007 Fixed in 8.9.01.001 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-10958 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d60c5fd2604a Credits Arkadiusz...

WordPress Form Maker by 10Web Plugin <= 1.15.30 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.30 Fixed in 1.15.31 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10265 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0450360afe6c Credits vgo0...

imagemagick:encoder_mvg_fuzzer: Use-of-uninitialized-value in TracePath

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6033501545103360 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

WordPress Charitable Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Charitable Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10876 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2a28f1e125bc Credits Peter Thaleikis...

WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 – PayPal & Stripe Add-on Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10683 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 86607dd77930...

Mars: Customer Data Exposure via Insecure Endpoint of coupon

A security vulnerability was identified in the Royal Canin Greece website. An insecure API endpoint was exposed that allowed unauthorized access to customer information without requiring authentication. The endpoint related to coupon functionality and revealed sensitive customer data, including...

imagemagick:encoder_ttf_fuzzer: Heap-buffer-overflow in tt_cmap4_next

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5118640413802496 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderttffuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

TestRail CLI FieldsParser eval Injection

This is not a very exciting vulnerability, but I had already publicly disclosed it on GitHub at the request of the vendor. Since that report has disappeared, the link I had provided to MITRE was invalid, so here it is again. -Devin --- Unsafe eval in TestRail CLI FieldsParser Date Reported:...

WordPress Wp-ImageZoom Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Wp-ImageZoom Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9934 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 48857c949d4e Credits Mohammad Nikouei Requir...

WordPress Tickera Plugin <= 3.5.4.4 is vulnerable to Broken Access Control

Software Tickera Type Plugin Vulnerable versions = 3.5.4.4 Fixed in 3.5.4.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10263 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7ffc68e88c86 Credits Arkadiusz Hydzik Required...

WordPress WS Form LITE Plugin <= 1.9.244 is vulnerable to Cross Site Scripting (XSS)

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.244 Fixed in 1.9.245 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10647 Patch priority Medium CVSS severity Medium 7.1 Developer WS Form PSID fff125dfb47d Credits Peter Thaleikis Required...

ffmpeg:ffmpeg_AV_CODEC_ID_RV60_fuzzer: Heap-buffer-overflow in decode_slice

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5139483386773504 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDRV60fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

WordPress Responsive Data Table Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Data Table Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51710 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 929bb6af39fb Credits João Pedro S Alcântara Kinorth...

WordPress Dashing Memberships Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Dashing Memberships Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51760 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 753de7df4cde Credits Mika Required privilege...