CVE-2024-24705

CVE-2024-24705 : CSRF vulnerability in the WordPress Accessibility plugin (

CVE-2024-24708

CVE-2024-24708 is a CSRF vulnerability in the WordPress plugin W3SPEEDSTER (W3SPEEDSTER WP). Affected versions are

CVE-2024-25931

CVE-2024-25931 is a Cross-Site Request Forgery (CSRF) vulnerability in the Heureka WordPress plugin, affecting versions

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0...

Sql injection

Osclass 5.1.2 is vulnerable to SQL Injection...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69...

CVE-2024-25932

CVE-2024-25932 is a CSRF vulnerability in the WordPress plugin Change Table Prefix affecting versions up to 2.0. The issue is described as CSRF via the form path change_prefix_form, potentially allowing unauthenticated or malicious actions on behalf of a logged-in user. Public details confirm the...

CVE-2024-24868

CVE-2024-24868 affects the WordPress plugin SP Project & Document Manager (versions up to 4.69). It is a SQL Injection due to improper neutralization of input in the plugin, enabling unauthorized data access/injection via authenticated conduit. The issue is mitigated by upgrading to version 4.70,...

CVE-2024-25927

CVE-2024-25927 refers to a SQL Injection vulnerability in the WordPress plugin postMash – custom post order, affecting versions up to and including 1.2.0. The issue arises from improper neutralization of elements in SQL commands (SQLi). The available connected documents confirm it is exploitable ...

CVE-2024-1965

CVE-2024-1965 describes a Server-Side Request Forgery in Haivision’s Aviwest Manager and Aviwest Steamhub. The issue allows an attacker to enumerate internal network configuration and potentially retrieve requests from other users by compromising an internal server, without credentials. Documente...

Code injection

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...

Input validation

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue...

Information disclosure

Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area...

Cross site scripting

Potential Cross-Site Scripting XSS in the page editing area...

CVE-2024-21886

CVE-2024-21886 is a heap buffer overflow in the X.Org server’s DisableDevice function. Affected: xorg-x11-server (and Xorg/Xwayland components in related advisories). Impact per sources: may cause an application crash or, in SSH X11 forwarding environments, remote code execution. Publicly referen...

CVE-2024-21885

CVE-2024-21885: A heap/buffer overflow in Xorg’s XISendDeviceHierarchyEvent within the XXIHierarchyInfo handling can occur when new device IDs are added, potentially causing an application crash or remote code execution in SSH X11 forwarding. The issue is tied to the xorg-x11-server code path and...

CVE-2024-1636

CVE-2024-1636 is a reported Cross-Site Scripting (XSS) issue described as affecting the page editing area in Sitefinity CMS (Progress). The Red Hat entry reiterates the same CVE and frames it in terms of low-privilege user access potentially impacting the Sitefinity backend. Public documents do n...

CVE-2024-1632

CVE-2024-1632 is a vulnerability in Progress Sitefinity CMS where low-privileged users with backend access can obtain sensitive information from the administrative area. The connected sources confirm the issue affects the Sitefinity backend and constitutes an information disclosure (confidentiali...

CVE-2024-1719

CVE-2024-1719 affects the WordPress plugins by Easy PayPal & Stripe Buy Now Button (up to 1.8.3) and Contact Form 7 – PayPal & Stripe Add-on (up to 2.1). The root cause is missing or incorrect nonce validation in the function "wpecpp_stripe_connect_completion", enabling CSRF. As described, unauth...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: i2c: img-scb: fix reference leak when pmruntimegetsync fails The PM reference count is not expected to be incremented on return in functions imgi2cxfer and imgi2cinit. However, pmruntimegetsync will increment the PM reference cou...