CVE-2024-32828

CVE-2024-32828 describes a missing authorization vulnerability in the WordPress plugin “Flexible Shipping” (Octolize). Affected range: Flexible Shipping versions up to 4.24.15. Root cause per the provided docs is a missing authorization check that allows performing an unauthorized action. The con...

CVE-2024-32829

CVE-2024-32829 is a missing-authorization vulnerability in the WordPress plugin Data Tables Generator by Supsystic . Affected versions are listed as from n/a through 1.10.31. The CVSS v3.1 base score is 4.3 (Medium). Root cause per the description is missing authorization, but the documents do no...

CVE-2024-32957

CVE-2024-32957 is a Missing Authorization vulnerability in Live Composer Page Builder (Live Composer). Affected: Page Builder: Live Composer

CVE-2024-33679

CVE-2024-33679 is described in connected sources as a Cross-Site Request Forgery (CSRF) vulnerability affecting FameThemes FameTheme Demo Importer for WordPress, with affected versions up to 1.1.5. The primary documents specify the CSRF issue and the affected plugin, including CVSS 3.1 base score...

CVE-2024-33680

CVE-2024-33680 is a CSRF vulnerability affecting the WordPress plugin MainWP Child Reports up to version 2.1.1. The connected Red Hat advisory confirms the issue as a CSRF vulnerability in MainWP Child Reports; no public details on root cause specifics beyond CSRF, affected versions, or any avail...

CVE-2024-33682

Technical details for CVE-2024-33682 are not provided in the connected documents. Information such as affected versions, exploit vectors, impact, or fixes is not publicly disclosed here. Monitor for updates from official advisories and trusted vulnerability databases.

CVE-2024-0740

CVE-2024-0740 affects Eclipse Target Management: Terminal and Remote System Explorer (RSE) versions

CVE-2024-22091

CVE-2024-22091 affects Mattermost servers where the path of requests containing user inputs is not length-limited. The root cause is an insufficient limit on the size of request paths, which can trigger excessive resource consumption and potentially cause a DoS. Affected versions include Mattermo...

CVE-2024-33638

CVE-2024-33638 is a CSRF vulnerability in Brijesh Kothari Smart Maintenance Mode for WordPress, affecting Smart Maintenance Mode versions from n/a through 1.4.4. The available documents provide the vulnerability description but do not specify the root cause details, affected functions, exploit me...

CVE-2024-33651

Technical details about CVE-2024-33651 are not present in the provided Connected Documents. The MF Gig Calendar CSRF issue, including vulnerable versions and impact, is only stated in the Initial Description; no CVE specifics, exploit info, or fixes are provided.

CVE-2024-3059

The CVE CVE-2024-3059 affects the ENL Newsletter WordPress plugin (versions ≤ 1.0.1). It reports CSRF checks missing in certain areas, enabling CSRF attackers to make logged-in admins delete arbitrary campaigns. Public details in connected docs confirm impact and affected software but do not prov...

CVE-2024-2429

CVE-2024-2429 affects the Salon Booking System WordPress plugin (up to 9.6.5). The issue is a missing CSRF check in the plugin’s settings update flow, allowing a logged-in admin to alter settings via CSRF. The Red Hat advisory reiterates this description. Exploitation status is not provided in th...

CVE-2024-0905

The vulnerability CVE-2024-0905 affects the Fancy Product Designer WordPress plugin up to version 6.1.8. It enables Reflected XSS by failing to sanitize/escape a parameter before echoing it on the page, potentially impacting unauthenticated users and admin users. The recommended fix is upgrading ...

CVE-2024-33259

CVE-2024-33259 affects JerryScript: a segmentation fault in the scanner_seek component of jerry-core/parser/js/js-scanner-util.c, observed in version cefd391. Impact is described as a high availability risk with no confidentiality/integrity impact per the cited CVSS data, and exploitation would b...

CVE-2024-31755

CVE-2024-31755 affects cJSON v1.7.17, where a segmentation fault can be triggered via the second parameter to cJSON_SetValuestring in cJSON.c. The Connected documents corroborate exploitation in multiple Linux distributions and advisories, e.g., Fedora/Fedora security updates reference cjson-1.7....

CVE-2024-33342

CVE-2024-33342 affects D-Link DIR-822+ (V1.0.5). A command injection exists in the SetPlcNetworkpwd function of prog.cgi, enabling remote attackers to execute arbitrary shell commands. Impact is remote code execution with network access, no user interaction required. Public sources (NVD/Red Hat/C...

CVE-2024-33255

CVE-2024-33255 affects JerryScript. The issue is an assertion failure in ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) within ecma_free_string_list, associated with commit cefd391 of JerryScript. Connected sources provide the exact vulnerable component and commit but do not specify affected product...

CVE-2024-28327

CVE-2024-28327 affects Asus RT-N12+ B1 router. The root cause is that the device stores user passwords in plaintext, enabling local attackers to obtain unauthorized access and modify router settings. Documented impact is high (local access, confidentiality/integrity/availability at risk). Publicl...

CVE-2024-31502

CVE-2024-31502 affects Insurance Management System v1.0.0 and earlier. The issue is a permissions problem in the /admin/core/new_staff endpoint that allows a remote attacker to escalate privileges via a crafted POST request. The CVE entry provides a high-severity score (CVSS 3.1: AV:N/AC:L/PR:L/U...

CVE-2024-31828

CVE-2024-31828 affects Lavalite CMS v10.1.0 with a Cross-Site Scripting (XSS) vulnerability exploitable via a crafted payload in the URL. Root cause cited across sources as improper input/URL handling allowing arbitrary code execution and leakage of sensitive info. Mitigation guidance in connecte...