PT-2024-17910 · WordPress · Smart Forms

Name of the Vulnerable Software and Affected Versions: The Smart Forms WordPress plugin versions prior to 2.6.94 Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as...

WordPress EZ Form Calculator Plugin <= 2.14.0.3 is vulnerable to Cross Site Scripting (XSS)

Software EZ Form Calculator Type Plugin Vulnerable versions = 2.14.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32133 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fc5e2a21aa0e Credits Dimas Maulana Required...

WordPress Jobs for WordPress Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)

Software Jobs for WordPress Type Plugin Vulnerable versions = 2.7.5 Fixed in 2.7.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32149 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a8a1acfb2c60 Credits Khalid Yusuf Required privile...

AMD Radeon Vulnerabilities - Lenovo Support US

No description provided...

WordPress Gutenberg Plugin 12.9.0-18.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Type Plugin Vulnerable versions 12.9.0-18.0.0 Fixed in 18.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID eb06fcdb1075 Credits John Blackbourn Required privilege...

nodejs:20 security update

nodejs 1:20.11.1-1 - Rebase to version 20.11.1 - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 high - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 medium nodejs-nodemon nodejs-packaging...

WordPress 5 Stars Rating Funnel Plugin <= 1.2.67 is vulnerable to Arbitrary Content Deletion

Software 5 Stars Rating Funnel Type Plugin Vulnerable versions = 1.2.67 Fixed in 1.3.02 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-31358 Patch priority Medium CVSS severity Medium 7.5 Developer Tobias PSID bd96c1e147ac Credits Emili Castells...

WordPress WP-Stateless Plugin <= 3.4.0 is vulnerable to Broken Access Control

Software WP-Stateless Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1385 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 12374ce1567e Credits Krzysztof Zając Required...

WordPress ELEX WooCommerce Dynamic Pricing and Discounts Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software ELEX WooCommerce Dynamic Pricing and Discounts Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31255 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4d8f4c47ac76 Credits L...

PT-2026-31495

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A use-after-free issue existed in the Navigation component of Google Chrome. This allowed a remote attacker to potentially execute arbitrary code within a sandbox environment by using a...

WordPress RapidLoad Power-Up for Autoptimize Plugin <= 2.2.11 is vulnerable to Server Side Request Forgery (SSRF)

Software RapidLoad Power-Up for Autoptimize Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Server Side Request Forgery SSRF CVE CVE-2024-31288 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID...

WordPress Classified Listing Plugin <= 3.0.4 is vulnerable to Broken Access Control

Software Classified Listing Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1352 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 21a429c4da7b Credits Francesco Carlucci...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Broken Access Control

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31307 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 88c85a953f3f Credits Rafie Muhammad...

WordPress AWP Classifieds Plugin <= 4.3.1 is vulnerable to Broken Access Control

Software AWP Classifieds Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31350 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a2e0652e7562 Credits Abdi Pranata Required...

WordPress Modal Popup Box Plugin <= 1.5.2 is vulnerable to PHP Object Injection

Software Modal Popup Box Type Plugin Vulnerable versions = 1.5.2 Fixed in 1.5.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-2008 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 963c409562cd Credits Francesco Carlucci Required privilege...

USN-6558-1: audiofile vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could...

USN-6539-1: python-cryptography vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that the python-cryptography Cipher.updateinto function would incorrectly accept objects with immutable buffers. This would result in corrupted output, contrary to expectations. This iss...

USN-6666-1: libuv vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libuv incorrectly truncated certain hostnames. A remote attacker could possibly use this issue with specially crafted hostnames to bypass certain checks. Update Instructions: Run su...

USN-6644-2: LibTIFF vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description USN-6644-1 fixed vulnerabilities in LibTIFF. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that LibTIFF incorrectly handled certain file...

WordPress Oxygen Builder Plugin <= 4.9 is vulnerable to Remote Code Execution (RCE)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-31380 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4b3933c6a6e8 Credits Snicco Required privilege Contributo...