CVE-2023-41955

CVE-2023-41955 is an Improper Privilege Management vulnerability in the WordPress plugin Essential Addons for Elementor (WPDeveloper). The flaw enables Privilege Escalation for authenticated users (Contributor/above) across versions up to 5.8.8 . The NVD entry lists a CVSS v3.1 base score of 8.8 ...

CVE-2023-41665

CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP

CVE-2023-39163

CVE-2023-39163 (Phlox Shop) is an Unauthenticated Local File Inclusion in Averta Phlox Shop WordPress plugin, affecting versions up to 2.0.0. The issue arises from a path traversal vulnerability that allows local file inclusion. CVSS v3.1 score is 8.6 (High) with Network attack vector and no user...

CVE-2023-37888

CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...

CVE-2023-25050

CVE-2023-25050 affects WordPress Shortcodes Ultimate (versions n/a through 5.12.6). The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that enables Absolute Path Traversal. Public sources (Patchstack; CVE records; Red Hat advisory) confirm the iss...

CVE-2023-23872

CVE-2023-23872 affects the WordPress plugin GMace (

CVE-2023-23645

CVE-2023-23645 affects the WordPress plugin MainWP Code Snippets Extension (versions

CVE-2022-44581

CVE-2022-44581 affects the WordPress Defender Security plugin (WPMU DEV Defender Security) with versions up to 3.3.2. Multiple connected sources describe insecure storage of sensitive information and note that screen temporary files may expose sensitive data. Patchstack frames the issue as Broken...

CVE-2021-32026

CVE-2021-32026 affects the NATS server (nats-server) prior to version 2.2.3. The issue arises when TLS parameters are supplied via CLI flags, which overrides the default restricted ciphersuite settings and allows negotiation of all ciphersuites supported by Go. The documented impact is potential ...

Grafana Fine-grained access control vulnerability

Impact On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, ad...

CVE-2023-43040

Summary: CVE-2023-43040 affects IBM Spectrum Fusion HCI (Ceph RGW) and Ceph RGW in IBM Storage Ceph, with versions 2.5.2–2.7.2 vulnerable to unauthorized actions in RGW due to improper bucket access. An unprivileged user can write to any bucket accessible by the signed key when a POST form-data b...

The Future of Phishing Email Training for Employees in Cybersecurity

By Waqas Discover the future of phishing email training, including personalized simulations, gamification, AI, and realistic scenarios. Empower your employees to combat evolving cyber threats and protect your organization. This is a post from HackRead.com Read the original post: The Future of...

CVE-2024-27280

CVE-2024-27280 describes a buffer-overread in StringIO. The ungetbyte/ungetc methods can read past end, causing StringIO.gets to return memory values. Affected: Ruby 3.0.x up to 3.0.6 and 3.1.x up to 3.1.4; fixed in Ruby 3.0.x by stringio 3.0.1.1 for 3.0 users, and in Ruby 3.1.x by stringio 3.0.1...

CVE-2024-1438

The CVE-2024-1438 entry concerns the WordPress plugin Rolo Slider (PressFore Ro lo Slider). Technical details in connected docs show a Missing Authorization vulnerability that allows unauthorized changes to settings in Rolo Slider versions up to and including 1.0.9. Public sources consistently de...

CVE-2022-40218

The CVE-2022-40218 entry concerns the WordPress plugin ThemeHunk Advance Product Search (WordPress TH Advance Product Search Plugin), affecting versions 1.1.4 and earlier. The root cause is a missing authorization check that allows an unauthenticated user to change plugin settings, enabling impac...

CVE-2023-41651

CVE-2023-41651 corresponds to a WordPress plugin vulnerability in the Multi-column Tag Map plugin (versions

CVE-2024-23710

CVE-2024-23710 affects Google Android: a logic error in InstallPackageHelper.java (assertPackageWithSharedUserIdIsPrivileged) could allow local elevation of privilege by executing arbitrary code as a privileged app, without extra privileges or user interaction. Impact is described as high (CVE-20...

CVE-2024-23704

CVE-2024-23704 is an elevation-of-privilege vulnerability in Android’s WifiDialogActivity.onCreate that bypasses DISALLOW_ADD_WIFI_CONFIG due to a missing permission check. Exploitation requires local access with no user interaction; no remote vector is described. Multiple connected sources (NVD,...

CVE-2024-0026

CVE-2024-0026 corresponds to a DoS in Android’s SnoozeHelper.java, causing a persistent denial of service through resource exhaustion. Affected component: Android framework/system code on Google Android. Impact: local DoS with no extra execution privileges and no user interaction required. Source...

CVE-2024-23694

CVE-2024-23694 is an Android Bluetooth elevation-of-privilege issue reported in Pixel/Android bulletins. The connected OSV entry details a use-after-free in a paired Bluetooth LE audio device that can enable code execution with no user interaction, on affected Pixel and non-Pixel Android devices....