CVE-2024-33938

CVE-2024-33938: Missing Authorization in Sliding Widgets (WordPress) allows cross-site scripting (XSS) in versions up to 1.5.0; affected plugin: Sliding Widgets. Patch/mitigation: upgrade to 1.5.0 or later (as per public records). If details are incomplete in provided docs, note that explicitly.

CVE-2024-33930

CVE-2024-33930 is a URL Open Redirect in the Share This Image WordPress plugin. The vulnerability affects Share This Image versions up to 1.97 (per the CVE entry) and is classified as an Open Redirect with network attack vector and user interaction required. Red Hat and Wordfence references in co...

CVE-2024-32114

Apache ActiveMQ 6.x is affected by CVE-2024-32114 due to an insecure default configuration that leaves the API web context (Jolokia JMX REST API and Message REST API) unauthenticated. This allows an attacker to access these layers without credentials and, per the advisory, potentially interact wi...

CVE-2024-3477

CVE-2024-3477 affects the Popup Box WordPress plugin pre-2.2.7. The vulnerability stems from missing CSRF checks in certain bulk actions, allowing an authenticated attacker to induce logged-in admins to perform unintended operations (e.g., deleting popups) via CSRF. The Red Hat and PatchStack ent...

CVE-2024-3476

The CVE-2024-3476 entry concerns the WordPress plugin Side Menu Lite (versions prior to 4.2.1). A CSRF flaw in certain bulk actions could allow an attacker to cause logged-in admins to perform unintended actions (e.g., deleting items). Root cause: lack of CSRF checks on bulk actions. Impact is de...

CVE-2024-2405

The CVE-2024-2405 entry concerns the WordPress plugin Float Menu, with versions prior to 6.0.1 lacking a CSRF check in bulk actions. The risk described is that a logged-in attacker could trigger CSRF to cause an admin to delete menus. Public sources consistently label the issue as CSRF in bulk ac...

CVE-2024-3475

The CVE-2024-3475 issue concerns the Sticky Buttons WordPress plugin. Connected sources confirm that versions prior to 3.2.4 ship with missing CSRF checks on certain bulk actions, enabling an attacker with admin privileges to cause logged-in admins to perform unwanted actions (e.g., deleting butt...

CVE-2024-3472

CVE-2024-3472 affects the WordPress Modal Window plugin prior to version 5.3.10. It lacks CSRF protection for bulk deletion of modals, enabling CSRF-based admin actions. Red Hat and Patchstack entries corroborate the issue and list the fix as updating to 5.3.10. Remediation: upgrade to 5.3.10 or ...

CVE-2024-31967

The CVE affects Mitel 6800 Series (up to 6.3 SP3 HF4), Mitel 6900 Series (up to 6.3 SP3 HF4), Mitel 6900w Series SIP Phone (up to 6.3.3), and Mitel 6970 Conference Unit (up to 5.1.1 SP8). Root cause is improper access control allowing an unauthenticated attacker to access user information or syst...

CVE-2024-29309

CVE-2024-29309 affects Alfresco Content Services v23.3.0.7, where the Transfer Service enables remote code execution. Impact: attacker can execute arbitrary code remotely over the network with no user interaction. Root cause: vulnerability in the Transfer Service component. Mitigation/workaround:...

CVE-2024-33302

CVE-2024-33302 affects SourceCodester Product Show Room 1.0 and earlier. The vulnerability is a cross-site scripting (XSS) flaw in the Middle Name field under Add Users, enabling script injection. Per the CVSS data, the attack vector is local with low privileges, no user interaction required, and...

CVE-2024-33394

CVE-2024-33394 affects kubevirt packages. Connected docs specify: vulnerable versions are kubevirt < 0.59.0-30 and kubevirt

CVE-2024-25290

The CVE-2024-25290 issue affects Casa Systems NL1901ACV R6B032, where a remote attacker can execute arbitrary code via the userName parameter of the add function. Public sources (NVD, Red Hat, CNNVD, CVE.org listings, PT Security) consistently identify the affected product and the vulnerability c...

CVE-2024-31966

The CVE-2024-31966 issue affects Mitel 6800 Series and 6900 Series SIP Phones (through 6.3 SP3 HF4), Mitel 6900w Series SIP Phone (through 6.3.3), and Mitel 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient parameter sanitization, allowing an authenticated attacker with adm...

CVE-2024-33303

CVE-2024-33303 affects SourceCodester Product Show Room 1.0 with a Cross Site Scripting (XSS) vulnerability exploitable via the First Name field under Add Users. The NVD entry lists CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with base score 8.2 (HIGH); impact is confidentiality high, integrit...

CVE-2024-29011

SonicWall GMS Virtual Appliance (Windows) ECM endpoint is affected by CVE-2024-29011 due to a hard-coded credential in the ECMClientAuthenticator class, enabling authentication bypass. Affected: GMS versions 9.3.4 and earlier. Impact: remote authentication bypass; no public exploit details provid...

CVE-2024-29010

CVE-2024-29010 affects SonicWall GMS (Virtual Appliance/Windows) – versions 9.3.4 and earlier. The issue resides in the ECM URL endpoint’s XML processing, where insufficient XML External Entity (XXE) handling can lead to disclosure of sensitive information. Affected component: ECM Policy XML proc...

CVE-2024-20378

Cisco IP Phone firmware vulnerabilities stem from lack of authentication on the web-based management interface. Affected products include Cisco IP Phone 6800, 7800, and 8800 series (and Cisco Video Phone 8875) with multiplatform firmware. An unauthenticated, remote attacker could access specific ...

CVE-2024-28764

IBM WebSphere Automation 1.7.0 is affected by a CSV injection vulnerability caused by improper validation of CSV file contents. An attacker with privileged network access could execute arbitrary commands on the system (impacting confidentiality, integrity, and availability). The issue stems from ...

CVE-2024-23480

CVE-2024-23480 affects Zscaler Client Connector on macOS prior to version 4.2. The vulnerability arises from a fallback mechanism in code-sign checking that could allow arbitrary code execution. Impact is described in sources as potentially total for exploitation paths, with local/low complexity ...