WordPress Digital Lottery Plugin <= 3.0.5 is vulnerable to Arbitrary File Upload

Software Digital Lottery Type Plugin Vulnerable versions = 3.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49242 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 7676461ee2c0 Credits stealthcopter Required privilege...

WordPress ADIF Log Search Widget Plugin <= 1.0f is vulnerable to Cross Site Scripting (XSS)

Software ADIF Log Search Widget Type Plugin Vulnerable versions = 1.0f Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49238 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 10e10eee4580 Credits Le Ngoc Anh Required privile...

CVE-2024-45403

CVE-2024-45403 affects the H2O HTTP server when configured as a reverse proxy. The issue is an assertion failure caused by cancelled HTTP/3 requests, enabling a denial-of-service attack. By default, the standalone H2O server restarts automatically, which mitigates impact, but concurrent requests ...

WordPress Bot for Telegram on WooCommerce Plugin <= 1.2.4 is vulnerable to Sensitive Data Exposure

Software Bot for Telegram on WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Sensitive Data Exposure CVE CVE-2024-9821 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4a69a61df293 Credits István Márton Required...

CVE-2024-47869

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

WordPress Talkback Plugin <= 1.0 is vulnerable to PHP Object Injection

Software Talkback Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-48033 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 110f16d8c997 Credits LVT-tholv2k Required privilege Unauthenticated...

WordPress IP Loc8 Plugin <= 1.1 is vulnerable to PHP Object Injection

Software IP Loc8 Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-48028 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 037f1dc8325d Credits LVT-tholv2k Required privilege Unauthenticated...

WordPress Tainacan Plugin <= 0.21.8 is vulnerable to SQL Injection

Software Tainacan Type Plugin Vulnerable versions = 0.21.8 Fixed in 0.21.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-48040 Patch priority High CVSS severity High 8.5 Developer Tainacan Community PSID 8db23d195d90 Credits Trương Hữu Phúc truonghuuphuc Required privilege...

Upgrade tinyMCE to >= 7.0.0 to mitigate CVE-2024-29881/29203

h3. Issue Summary The current tinyMCE version used on the latest version of Jira is 5.10.9. There are two outstanding CVEs between the delta of 5.10.9 to 7.0.0 that don't seem to be backported yet: CVE-2024-29881 Detail - NVD|https://nvd.nist.gov/vuln/detail/CVE-2024-29881 CVE-2024-29203 Detail -...

WordPress BuddyPress Docs Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Software BuddyPress Docs Type Plugin Vulnerable versions = 2.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9207 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d79eef12da8e Credits vgo0 Required...

WordPress Bit File Manager Plugin <= 6.5.7 is vulnerable to Arbitrary File Upload

Software Bit File Manager Type Plugin Vulnerable versions = 6.5.7 Fixed in 6.5.8 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-8743 Patch priority High CVSS severity High 6.8 Developer Claim ownership PSID c3b2ce42763f Credits TANG Cheuk Hei siunam Required privileg...

WordPress Auto Amazon Links Plugin <= 5.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Auto Amazon Links Type Plugin Vulnerable versions = 5.4.2 Fixed in 5.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9349 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 432d964bd7ed Credits vgo0 Required...

WordPress Smart Custom 404 Error Page Plugin <= 11.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Smart Custom 404 Error Page Type Plugin Vulnerable versions = 11.4.7 Fixed in 11.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9204 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6f4afc297c2e Credits...

WordPress SEOPress Plugin <= 8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software SEOPress Type Plugin Vulnerable versions = 8.1.1 Fixed in 8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9225 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 788a715fcbd5 Credits vgo0 Required privilege...

WordPress LH Copy Media File Plugin <= 1.08 is vulnerable to Cross Site Scripting (XSS)

Software LH Copy Media File Type Plugin Vulnerable versions = 1.08 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9220 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f98d57ff7d4d Credits Colin Xu Required...

WordPress Hello World Plugin <= 2.1.1 is vulnerable to Arbitrary File Download

Software Hello World Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-9224 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 936cc3342bfb Credits yudha Required privilege...

WordPress Wechat Social login Plugin <= 1.3.0 is vulnerable to Broken Authentication

Software Wechat Social login Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9106 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 26efb59ee707 Credits Istvá...

WordPress Wechat Social login Plugin <= 1.3.0 is vulnerable to Arbitrary File Upload

Software Wechat Social login Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9108 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 7303314c8667 Credits István Márton Required privilege...

WordPress BA Book Everything Plugin <= 1.6.20 is vulnerable to Cross Site Scripting (XSS)

Software BA Book Everything Type Plugin Vulnerable versions = 1.6.20 Fixed in 1.6.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47360 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e3cd73e82790 Credits Dimas Maulana Required...

WordPress JobSearch Plugin <= 2.5.9 is vulnerable to PHP Object Injection

Software JobSearch Type Plugin Vulnerable versions = 2.5.9 Fixed in 2.6.1 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-47636 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5e0aa88de68e Credits Bonds Required privilege Unauthenticated...