Design/Logic Flaw

Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. Chromium security severity: Medium...

WordPress WP Go Maps Plugin <= 9.0.28 is vulnerable to Cross Site Scripting (XSS)

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.28 Fixed in 9.0.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6697 Patch priority Medium CVSS severity Medium 7.1 Developer WP Go Maps PSID a5d68fb003d8 Credits Nex Team Required privileg...

Google Chrome < 121.0.6167.85 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 121.0.6167.85. It is, therefore, affected by multiple vulnerabilities as referenced in the 202401stable-channel-update-for-desktop23 advisory. - Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allow...

Google Chrome < 121.0.6167.85 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 121.0.6167.85. It is, therefore, affected by multiple vulnerabilities as referenced in the 202401stable-channel-update-for-desktop23 advisory. - Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85...

WordPress WP Customer Area Plugin <= 8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Customer Area Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0665 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f88bc5bdc8b9 Credits Krzysztof Zając...

CVE-2024-0813

Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. Chromium security severity: Medium...

CVE-2024-0805

Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Medium...

CVE-2024-0814

Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-0806

Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. Chromium security severity: Medium...

CVE-2024-0806

Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. Chromium security severity: Medium...

WordPress WPForms Pro Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Pro Type Plugin Vulnerable versions = 1.8.5.3 Fixed in 1.8.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7063 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b002ca3b6fb7 Credits drop Required...

WordPress ColorMag Theme <= 3.1.2 is vulnerable to Broken Access Control

Software ColorMag Type Theme Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0679 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a03b90ac4c61 Credits Sean Murphy Required privilege...

openSUSE 15 Security Update : seamonkey (openSUSE-SU-2024:0026-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0026-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

WordPress Slider by Supsystic Plugin <= 1.8.6 is vulnerable to Broken Access Control

Software Slider by Supsystic Type Plugin Vulnerable versions = 1.8.6 Fixed in 1.8.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47330 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 5be1957d9f7e Credits Abdi Pranata Requir...

WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Software BP Profile Search Type Plugin Vulnerable versions = 5.5 Fixed in 5.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22293 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5fc1725a4a59 Credits Le Ngoc Anh Required privilege...

openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0020-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0020-1 advisory. - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a...

WordPress SimpleMap Store Locator Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software SimpleMap Store Locator Type Plugin Vulnerable versions = 2.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22282 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2ef3007a7000 Credits Dimas Maulana Required...

WordPress WOLF Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software WOLF Type Plugin Vulnerable versions = 1.0.8 Fixed in 1.0.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22159 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9666a70fedea Credits thiennv Required privilege Unauthenticate...

WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload

Software Product Import Export for WooCommerce Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-22152 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 7b62ca7055ba Credits Dateoljo of BoB...

WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Settings Change

Software SalesKing Type Plugin Vulnerable versions = 1.6.15 Fixed in 1.6.30 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-22156 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 22c1687edcfd Credits Dave Jong Patchstack Required...