CVE-2023-52217

CVE-2023-52217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin “WooCommerce Conversion Tracking.” Affected are versions up to 2.0.11; the issue stems from missing authorization controls in the plugin’s operations. The CVE entry notes a patch is available i...

CVE-2024-24704

CVE-2024-24704 is a Broken Access Control (Missing Authorization) vulnerability in Load More Anything for WordPress (

CVE-2023-52186

CVE-2023-52186 is a missing-authz vulnerability in the WordPress plugin “WooCommerce Product Vendors” affecting versions up to 2.2.2. The CVE’s base metrics (NVD) show CVSS 3.1, 5.3 (Medium), with network attack vector, no privileges required, no user interaction, and no confidentiality impact bu...

SUSE: Security Advisory (SUSE-SU-2024:1963-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-6818-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-48578

CVE-2022-48578 affects macOS Monterey AppleScript handling. The information provided shows an out-of-bounds read issue addressed by improved bounds checking, fixed in macOS Monterey 12.5. The AppleScript processing could lead to unexpected termination or disclosure of process memory, indicating a...

CVE-2024-22296

CVE-2024-22296 corresponds to a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin 12 Step Meeting List. Public records show affected versions are 3.14.28 and earlier, with exploitation potential via an unauthenticated or improperly authorized access to the plugin...

CVE-2024-22298

CVE-2024-22298 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Amelia Booking. The affected versions are Amelia Booking ≤ 1.0.98, with unauthenticated attackers able to access restricted actions due to missing authorization checks. Patchstack notes ...

CVE-2024-21751

CVE-2024-21751 concerns the WordPress plugin RabbitLoader up to version 2.19.13, where multiple AJAX actions lack proper authorization checks, allowing authenticated users with subscriber-level access and above to modify data (e.g., purge site cache or switch caching modes) without permission. Th...

CVE-2024-23524

CVE-2024-23524 is a Broken Access Control vulnerability in the PilotPress plugin for WordPress. Affected versions are

CVE-2024-25929

CVE-2024-25929: WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX

CVE-2024-25092

CVE-2024-25092 is a Missing Authorization vulnerability in WordPress NextMove Lite (XLPlugins NextMove Lite) affecting all versions through 2.17.0. An authenticated user with subscriber-level privileges or higher can install and activate arbitrary plugins due to a missing capability check (xl_add...

CVE-2023-34003

CVE-2023-34003 affects the WooCommerce Box Office plugin (versions

CVE-2023-51494

CVE-2023-51494 is a Missing Authorization vulnerability in the WooCommerce Product Vendors plugin (WordPress). Affected versions are WooCommerce Product Vendors up to 2.2.1. Root cause: insufficient authorization checks allowing unauthenticated access to vendor-related actions. Impact in the NVD ...

CVE-2023-52230

CVE-2023-52230 affects Booster Plus for WooCommerce, where versions prior to 7.1.3 expose an authenticated arbitrary WordPress option disclosure due to missing authorization. The issue is a missing authorization vulnerability that could allow a user with at least subscriber privileges to view or ...

CVE-2023-52232

CVE-2023-52232 : Booster Plus for WooCommerce (WordPress) prior to 7.1.2 has a Missing Authorization vulnerability (root cause: missing capability check) that allows an authenticated attacker to delete arbitrary posts/pages. Documented in Patchstack as Arbitrary Content Deletion with subscriber-l...

CVE-2024-21748

CVE-2024-21748 affects WordPress Icegram Engage plugin (Icegram) with versions up to 3.1.21. Root cause: Missing/Broken Authorization leading to unauthorized access. Patch 3.1.22 fixes the issue; severity reported as low (CVSS ~4.3).

CVE-2024-0444

CVE-2024-0444 concerns GStreamer and its AV1 parsing path. The flaw is a stack-based buffer overflow in the AV1 tile-list data parsing, caused by insufficient validation of the length of user-supplied data before copying to a fixed-size stack buffer. Exploitation can lead to remote arbitrary code...

CVE-2024-36790

CVE-2024-36790 applies to Netgear WNR614 (JNR1010V2/N300) with firmware versions 1.1.0.54 and 1.0.1, where credentials are stored in plaintext. The root cause is unencrypted storage of protected information on the device, enabling potential disclosure of credentials. The NVD entry lists a high im...

CVE-2024-36787

The CVE-2024-36787 entry concerns Netgear WNR614 routers (versions 1.1.0.54 and 1.0.1) where the authentication procedure contains weaknesses that allow bypassing authentication and gaining access to the administrative interface via unspecified vectors. The vulnerability is described across multi...