WordPress Wp Social Plugin <= 3.0.0 is vulnerable to Broken Access Control

Software Wp Social Type Plugin Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1763 Patch priority Medium CVSS severity Medium 6.5 Developer Wpmet PSID e224abf48843 Credits Krzysztof Zając Required privilege...

WordPress Giveaways and Contests by RafflePress Plugin <= 1.12.5 is vulnerable to Cross Site Scripting (XSS)

Software Giveaways and Contests by RafflePress Type Plugin Vulnerable versions = 1.12.5 Fixed in 1.12.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1935 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ece07ad4b4ef...

Facebook bug could have allowed attacker to take over accounts

A vulnerability in Facebook could have allowed an attacker to take over a Facebook account without the victim needing to click on anything at all. The bug was found by a bounty hunter from Nepal called Samip Aryal and has now been fixed by Facebook. In his search for an account takeover...

USN-6581-1: GNU binutils vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that GNU binutils was not properly performing bounds checks in several functions, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of...

USN-6633-1: Bind vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consu...

USN-6566-1: SQLite vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the –safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS...

USN-6560-1: OpenSSH vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension...

WordPress Anti Hacker Plugin <= 4.51 is vulnerable to Broken Access Control

Software Anti Hacker Type Plugin Vulnerable versions = 4.51 Fixed in 4.52 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1860 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bbb1acb1d01e Credits Lucio Sá Required privilege...

WordPress Seraphinite Accelerator Plugin <= 2.20.52 is vulnerable to Server Side Request Forgery (SSRF)

Software Seraphinite Accelerator Type Plugin Vulnerable versions = 2.20.52 Fixed in 2.21 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-1568 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 699713e041d9 Credits Luci...

WordPress Smart Forms Plugin < 2.6.87 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions 2.6.87 Fixed in 2.6.87 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7203 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 959e4abbd849 Credits Mohammad Reza Omrani Require...

WordPress BeePress Plugin <= 6.9.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software BeePress Type Plugin Vulnerable versions = 6.9.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-27197 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 23f23a1e9a56 Credits Majed Refaea Required...

WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software postMash – custom post order Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27196 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f81d96aa3cf3 Credits Dimas Maulana Require...

WordPress Socialdriver Theme < 2024 is vulnerable to Cross Site Scripting (XSS)

Software Socialdriver Type Theme Vulnerable versions 2024 Fixed in 2024 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-4826 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6b8a90a1f910 Credits longxi Required privilege Unauthenticated...

WordPress Adsmonetizer Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Adsmonetizer Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-1437 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8446c2dca06a Credits Majed Refaea Required privilege...

WordPress Marketo Forms and Tracking Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Marketo Forms and Tracking Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2020-6849 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 49ac15351483 Credits Zeroauth...

WordPress Play.ht Plugin <= 3.6.4 is vulnerable to PHP Object Injection

Software Play.ht Type Plugin Vulnerable versions = 3.6.4 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1772 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 571b81755147 Credits Francesco Carlucci Required privilege Contribut...

SUSE CVE-2024-1672

Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2024-1671

Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-1673

Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. Chromium security severity: Medium...

CVE-2024-1672

Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...