WordPress Droip Plugin <= 1.1.1 is vulnerable to Settings Change

Software Droip Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43954 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID d2ffab5d4b5f Credits Dave Jong Patchstack Required privilege...

WordPress WP Crowdfunding Plugin <= 2.1.10 is vulnerable to Settings Change

Software WP Crowdfunding Type Plugin Vulnerable versions = 2.1.10 Fixed in 2.1.11 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43937 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID a39d1c35c66c Credits Trương Hữu Phúc truonghuuph...

WordPress String locator Plugin <= 2.6.5 is vulnerable to Cross Site Scripting (XSS)

Software String locator Type Plugin Vulnerable versions = 2.6.5 Fixed in 2.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6987 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1314ec6116ff Credits Rein Daelman trein...

WordPress Brickscore Plugin <= 1.4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Brickscore Type Plugin Vulnerable versions = 1.4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43950 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 72067279088d Credits Dave Jong Patchstack Required privile...

WordPress Simple Job Board Plugin <= 2.12.3 is vulnerable to PHP Object Injection

Software Simple Job Board Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.12.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7351 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a1947bfcfa95 Credits Francesco Carlucci Required privileg...

WordPress IntoTheDark Theme <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software IntoTheDark Type Theme Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43958 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3dbbd6a0c6a9 Credits justakazh Required privilege...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.6.2 is vulnerable to Broken Access Control

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.6.2 Fixed in 5.6.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43932 Patch priority Medium CVSS severity Medium 6.5 Developer POSIMYTH Innovations PSID...

WordPress Magic Post Thumbnail Plugin <= 5.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Magic Post Thumbnail Type Plugin Vulnerable versions = 5.2.9 Fixed in 5.2.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43921 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID df0d3514c8f0 Credits Le Ngoc Anh Required...

WordPress Testimonials Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Testimonials Type Plugin Vulnerable versions = 4.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43959 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8da344adddf2 Credits Abdi Pranata Required privilege...

WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.6.1 is vulnerable to Cross Site Scripting (XSS)

Software YellowPencil Visual CSS Style Editor Type Plugin Vulnerable versions = 7.6.1 Fixed in 7.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43963 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8ac87b1f76e Credits Le Ngoc Anh...

Webinar: Experience the Power of a Must-Have All-in-One Cybersecurity Platform

Let's be honest. The world of cybersecurity feels like a constant war zone. You're bombarded by threats, scrambling to keep up with patches, and drowning in an endless flood of alerts. It's exhausting, isn't it? But what if there was a better way? Imagine having every essential cybersecurity tool...

GitHub Patches Critical Security Flaw in Enterprise Server Granting Admin Privileges

GitHub has released fixes to address a set of three security flaws impacting its Enterprise Server product, including one critical bug that could be abused to gain site administrator privileges. The most severe of the shortcomings has been assigned the CVE identifier CVE-2024-6800, and carries a...

WordPress Sirv Plugin <= 7.2.7 is vulnerable to Arbitrary File Upload

Software Sirv Type Plugin Vulnerable versions = 7.2.7 Fixed in 7.2.8 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE N/A Patch priority Medium CVSS severity Medium 9.9 Developer Sirv PSID 9e701815e83c Credits scottaglia Required privilege Contributor Published 22 August, 2024...

CVE-2024-7972

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-7977

Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. Chromium security severity: Medium...

CVE-2024-7977

Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. Chromium security severity: Medium...

DEBIAN-CVE-2024-7974

Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2024-7980

Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. Chromium security severity: Medium...

DEBIAN-CVE-2024-7980

Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. Chromium security severity: Medium...

CVE-2024-7973

Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. Chromium security severity: Medium...