CVE-2024-3840

Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3840

CVE-2024-3840 affects Google Chrome/Chromium where insufficient policy enforcement in Site Isolation could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is mitigated in Chrome/Chromium 124.0.6367.60 (and newer); Debian security advisory lists 124.0.6...

CVE-2024-3837

Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3838

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...

CVE-2024-3838

CVE-2024-3838 affects Google Chrome/Chromium Autofill: an inappropriate Autofill implementation allowed UI spoofing via a crafted app, when a user is lured to install malware. The issue exists in Chrome prior to 124.0.6367.60; remediation is to upgrade to 124.0.6367.60 or newer. Exploitation deta...

CVE-2024-3837

CVE-2024-3837 is a Chrome/Chromium vulnerability described as a use-after-free in QUIC that could allow heap corruption when a renderer process is compromised. Affected software is Google Chrome/Chromium prior to version 124.0.6367.60. The underlying issue is triggered by crafted HTML pages, with...

WordPress MyRewards Plugin <= 5.3.0 is vulnerable to Broken Access Control

Software MyRewards Type Plugin Vulnerable versions = 5.3.0 Fixed in 5.3.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32688 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4a61d830f2db Credits Emili Castells Required...

WordPress Ovic Responsive WPBakery Plugin <= 1.3.0 is vulnerable to Broken Access Control

Software Ovic Responsive WPBakery Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32142 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 35ffc13b78da Credits Skalucy Required...

WordPress Superfly Menu Plugin <= 5.0.25 is vulnerable to Cross Site Scripting (XSS)

Software Superfly Menu Type Plugin Vulnerable versions = 5.0.25 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32553 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6079596969f5 Credits Dave Jong Patchstack Required...

WordPress QR Code Composer Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software QR Code Composer Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32560 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b079e25db67 Credits stealthcopter Required privileg...

WordPress Import Content in WordPress & WooCommerce with Excel Plugin <= 4.2 is vulnerable to Cross Site Scripting (XSS)

Software Import Content in WordPress & WooCommerce with Excel Type Plugin Vulnerable versions = 4.2 Fixed in 4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32585 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 597c127e874d Credits...

WordPress EnvíaloSimple Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software EnvíaloSimple Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32587 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID ce11fde5722d Credits Yudistira Arya Required privilege...

WordPress User Registration Plugin <= 3.1.5 is vulnerable to Broken Access Control

Software User Registration Type Plugin Vulnerable versions = 3.1.5 Fixed in 3.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3295 Patch priority Medium CVSS severity Medium 6.5 Developer Masteriyo PSID 0a09ce75cc11 Credits wesley wcraft Required...

WordPress Slider by 10Web Plugin <= 1.2.54 is vulnerable to Cross Site Scripting (XSS)

Software Slider by 10Web Type Plugin Vulnerable versions = 1.2.54 Fixed in 1.2.55 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32578 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3808548b6dad Credits Dimas Maulana Required privile...

WordPress Debug Log Manager Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Debug Log Manager Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-32582 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1f92fe55cb9f Credits Majed Refaea Required...

WordPress DirectoryPress Plugin <= 3.6.7 is vulnerable to Cross Site Scripting (XSS)

Software DirectoryPress Type Plugin Vulnerable versions = 3.6.7 Fixed in 3.6.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32567 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b3b3b9f83549 Credits Yudistira Arya Required privilege...

WordPress WP Simple HTML Sitemap Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Simple HTML Sitemap Type Plugin Vulnerable versions = 2.8 Fixed in 2.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-32574 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a36645ce9cc9 Credits CatFather Require...

Stable Channel Update for Desktop

The Stable channel has been updated to 124.0.6367.60/.61 for Windows and Mac and 124.0.6367.60 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 124.0.6367.60/.61 for Windows and M...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 23 security fixes: 331358160 High CVE-2024-3832: Object corruption in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27 331383939 High CVE-2024-3833: Object corruption in WebAssembly. Reported by Man Yue Mo of GitHub Security Lab on...

CVE-2024-1306

The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk...