CVE-2023-51692

CVE-2023-51692 affects the WordPress plugin Customer Reviews for WooCommerce (CusRev). Affected: CusRev for WooCommerce, versions up to 5.38.1. Issue: Missing Authorization (Broken Access Control) allowing unauthorized access via CR_Manual actions. Exploitation details are not provided in the doc...

Heap overflow

Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024...

CVE-2024-27103

Querybook (Big Data Querying UI) is affected by a stored XSS vulnerability (CVE-2024-27103) arising from unsanitized input passed to dangerouslySetInnerHTML during search result highlighting and in the query auto-suggestion feature. The issue is triggered when highlighted results or suggested tab...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8...

CVE-2023-51683

CVE-2023-51683 affects the WordPress plugin Easy PayPal & Stripe Buy Now Button (by Scott Paterson). Vulnerable component: the plugin’s CSRF protection allowing cross-site request forgery. Affected versions: 1.8.1 and earlier. Impact: CSRF could enable attacker-initiated actions on behalf of an a...

CVE-2023-52223

CVE-2023-52223 concerns a Cross-Site Forgery vulnerability in the WordPress MailerLite – WooCommerce integration plugin, affected versions

CVE-2024-0560

CVE-2024-0560 affects 3Scale when used with Keycloak 15 or RHSSO 7.5.0. The auth_type use_3scale_oidc_issuer_endpoint makes the Token Introspection policy read the token_introspection_endpoint field, which was removed in RH-SSO 7.5. As a result, tokens are not inspected and are treated as valid. ...

CVE-2023-52226

CVE-2023-52226 affects WordPress plugin Advanced Flamingo (versions

CVE-2024-23519

CVE-2024-23519 is a CSRF vulnerability in the WordPress plugin Email Before Download (M&S Consulting) affecting versions up to 6.9.7. The NVD/patch sources indicate a high-impact issue (CVSS v3.1 base score 8.8; network attack vector, no privileges required, user interaction required) that could ...

CVE-2024-24701

CVE-2024-24701 is a CSRF vulnerability in Setka Editor (WordPress plugin: setka-editor)

CVE-2024-20267

CVE-2024-20267 describes a denial-of-service vulnerability in Cisco NX-OS Software related to MPLS traffic handling. The issue arises from insufficient error checking when processing an ingress MPLS frame, enabling an unauthenticated, remote attacker to send a crafted IPv6 packet encapsulated in ...

CVE-2024-20321

CVE-2024-20321 affects Cisco NX-OS Software’s eBGP implementation. The issue arises because eBGP traffic is mapped to a shared hardware rate-limiter queue, enabling an unauthenticated, remote attacker to cause a DoS by sending large volumes of traffic with specific characteristics, potentially dr...

CVE-2024-23946

The CVE-2024-23946 issue is a path traversal/file inclusion vulnerability in Apache OFBiz. Affected product: Apache OFBiz prior to 18.12.12. Root cause: incorrect handling of file paths allowing access to files outside the web root. Impact: potential disclosure of sensitive files/directories; det...

CVE-2024-25065

CVE-2024-25065 affects Apache OFBiz. A path traversal issue allows authentication bypass. The issue impacts OFBiz versions before 18.12.12. Upgrade to 18.12.12 (or later) to fix; multiple sources (NVD, Red Hat, PRIoN, OSV) corroborate the vulnerability and fix. If applying mitigations, ensure ver...

CVE-2024-25128

Flask-AppBuilder (FAB) is affected when AUTH_TYPE is set to AUTH_OID. The vulnerability allows forging an HTTP request to trick the backend into using an attacker-controlled OpenID service, potentially granting unauthorized privilege access. The issue is exploitable with OpenID 2.0 and is mitigat...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5...

CVE-2024-24702

CVE-2024-24702 is a CSRF vulnerability in the WordPress plugin Page Restrict (versions up to and including 2.5.5). The issue allows an attacker to perform unintended actions on behalf of an authenticated user via a CSRF vector, with CVSSv3.1 base metrics indicating a HIGH impact on confidentialit...