UBUNTU-CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-47534

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

PT-2024-39478 · WordPress · Eu/Uk Vat Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: EU/UK VAT Manager for WooCommerce plugin for WordPress versions up to, and including, 2.12.12 Description: The issue allows unauthorized modification of data due to a missing capability check on the alg wc eu vat exempt vat from admin functio...

UBUNTU-CVE-2024-46847

In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: ensure vmapblock is initialised before adding to queue Commit 8c61291fd850 "mm: fix incorrect vbq reference in purgefragmentedblock" extended the 'vmapblock' structure to contain a 'cpu' field which is set at...

CVE-2024-9130

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

WordPress GiveWP plugin <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter vulnerability

Authenticated GiveWP Manager+ SQL Injection via order Parameter vulnerability discovered by Leo in WordPress Plugin GiveWP versions = 3.16.1...

PT-2024-32275 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.1 Description: A SQL Injection issue allows an authenticated lower-privileged user, with at least Network Manager permissions, to achieve privilege escalation to the admin account. This is related to the...

Security Bulletin: Vulnerability in linux affects IBM Integrated Analytics System [CVE-2024-40975]

Summary Redhat provided linux is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2024-40975 Vulnerability Details CVEID:CVE-2024-40975 DESCRIPTION: Linux Kernel could provide weaker than expected security, caused by unregister devices ...

PT-2024-39450 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions up to, and including, 3.16.1 Description: The issue is related to time-based SQL Injection via the order parameter due to insufficient escaping on the user-suppli...

WordPress Revolut Gateway for WooCommerce plugin <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update vulnerability

Missing Authorization to Unauthenticated Order Status Update vulnerability discovered by WordFence in WordPress Plugin Revolut Gateway for WooCommerce versions = 4.17.3...

CVE-2024-8678 Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders a...

CVE-2024-8484

The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of...

PT-2024-39050 · WordPress · Rest Api To Miniprogram

Name of the Vulnerable Software and Affected Versions: REST API TO MiniProgram plugin for WordPress versions up to, and including, 4.7.1 Description: The issue is related to SQL Injection via the order parameter of the "/wp-json/watch-life-net/v1/comment/getcomments" API endpoint. This is due to...

CVE-2024-9077

A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the file scripts/order.js of the component Order Checkout. The manipulation of the argument address-name leads to cross site scripting. It is...

CVE-2024-9077

A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the file scripts/order.js of the component Order Checkout. The manipulation of the argument address-name leads to cross site scripting. It is...

CVE-2024-9077 dingfangzu Order Checkout order.js cross site scripting

A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the file scripts/order.js of the component Order Checkout. The manipulation of the argument address-name leads to cross site scripting. It is...

CVE-2024-9077 dingfangzu Order Checkout order.js cross site scripting

A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the file scripts/order.js of the component Order Checkout. The manipulation of the argument address-name leads to cross site scripting. It is...

CVE-2024-9077

The CVE-2024-9077 entry concerns dingfangzu’s Order Checkout component, specifically the scripts/order.js file. The vulnerability is a cross-site scripting issue caused by manipulation of the address-name argument in an unknown function, with remote exploitability and public disclosure. The incid...

PT-2024-32486 · Iredadmin · Iredadmin

Name of the Vulnerable Software and Affected Versions: iRedAdmin versions prior to 2.6 Description: The issue is related to a Cross Site Scripting XSS vulnerability. This can be exploited via the order name parameter. The vulnerability allows an attacker to perform actions, view, or modify...

dingfanzu 跨站脚本漏洞

dingfanzu is a php-based food ordering website developed by gk2007, an individual developer. A cross-site scripting vulnerability exists in dingfanzu, which originates from the parameter address-name in the scripts/order.js file in the Order Checkout component and can lead to cross-site scripting...