CVE-2023-52210

CVE-2023-52210 concerns the WordPress plugin “Product Delivery Date for WooCommerce – Lite” (Tyche) with versions up to 2.7.0. Connected patchstack data indicates the root cause is broken access control that allows unauthenticated access, potentially impacting availability or operation. A fix is ...

CVE-2023-46612

CVE-2023-46612 describes a Missing Authorization vulnerability in the Mediabay Mediabay-lite WordPress plugin. The issue is a broken/insufficient access control that could allow unauthorized actions within Mediabay’s file management/features. Technical details in connected sources confirm affecte...

CVE-2023-46073

CVE-2023-46073 (DX Delete Attached Media) is a WordPress plugin vulnerability in which versions <= 2.0.5.1 expose Broken Access Control (Missing Authorization) via CSRF/bypass scenarios. The Patchstack entry confirms affected software (DX Delete Attached Media plugin), the root cause (broken a...

CVE-2023-28689

CVE-2023-28689 : WordPress plugin JS Job Manager (versions

CVE-2024-36041

The CVE-2024-36041 issue affects KDE Plasma Workspace (plasma-workspace) prior to 5.27.11.1 and 6.x prior to 6.0.5.1, where KSmserver incorrectly accepts ICE connections from localhost, allowing a local attacker to gain access to the session manager and potentially execute code on the victim at t...

CVE-2023-48759

CVE-2023-48759 is a Missing Authorization vulnerability in Crocoblock JetElements For Elementor (affected: Elementor JetElements <= 2.6.13). The issue allows unauthenticated users to download arbitrary attachments due to a missing authorization check on the download path (arbitrary attachment ...

CVE-2023-52217

CVE-2023-52217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin “WooCommerce Conversion Tracking.” Affected are versions up to 2.0.11; the issue stems from missing authorization controls in the plugin’s operations. The CVE entry notes a patch is available i...

CVE-2023-37888

CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...

CVE-2024-1657

CVE-2024-1657 : A flaw in Red Hat Ansible Automation Platform involves an insecure WebSocket used when interacting with the EDA server during installation from the Ansible rulebook. An attacker with access to any machine in the CIDR block could download all rulebook data, impacting confidentialit...

CVE-2024-1712

The Carousel Slider WordPress plugin prior to version 2.2.7 does not sanitize/escape certain settings, allowing Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Affected versions:

CVE-2024-2340

CVE-2024-2340 affects the WordPress Avada theme up to version 7.11.6. The vulnerability enables unauthenticated attackers to access sensitive files uploaded through Avada forms via the /wp-content/uploads/fusion-forms/ directory, causing sensitive information exposure. Root cause: directory listi...

CVE-2024-0826

CVE-2024-0826 affects Qi Addons For Elementor for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in widget attributes caused by insufficient input sanitization and output escaping, allowing authenticated users with contributor-level or higher permissions to inject scripts tha...

CVE-2024-2261

CVE-2024-2261 affects the Event Tickets and Registration plugin for WordPress (all versions up to 5.8.2). The exposure is via RSVP functionality, enabling authenticated users with contributor access or higher to retrieve sensitive data (emails, street addresses). Remediation noted in connected so...

CVE-2024-27991

CVE-2024-27991 affects the WordPress plugin SupportCandy (up to version 3.2.3). The issue is a Stored XSS caused by improper input neutralization during web page generation. Impact is stored XSS on affected pages; patch is available in 3.2.3 (upgrade to 3.2.3 or later). Other sources (Red Hat, NV...

CVE-2022-43876

CVE-2022-43876 affects IBM Security Verify Access OpenID Connect Provider container. The IBM bulletin states an information-disclosure flaw where web pages can be stored locally by the OIDC Provider and read by another user on the same system. Affected IBM Security Verify Access OIDC Provider ver...

CVE-2022-420004

CVE-2022-42004 is listed in IBM’s bulletin as part of the Jackson-Databind vulnerabilities affecting Eclipse Jetty/Jackson libraries; the entry describes a Denial of Service via Jackson Databind BeanDeserializer._deserializeFromArray, triggered by deeply nested arrays that exhaust resources. The ...

CVE-2023-358900

The connected IBM bulletin confirms CVE-2023-358900 affects IBM WebSphere Application Server traditional when shipped with IBM Intelligent Operations Center (IOC). Affected IOC versions: 1.5.0, 1.6.0, 1.6.0.1, 1.6.0.2, 1.6.0.3, and IOC for Emergency Management (Linux) 1.6.0. Remediation is to ins...

CVE-2022-41295

CVE-2022-41295 affects IBM Robotic Process Automation products. IBM Robotic Process Automation Client may be vulnerable to sensitive data being stored in temporary managed memory, enabling exposure of data in memory during operation. Affected products/versions: IBM Robotic Process Automation for ...