WordPress Unite Gallery Lite Plugin <= 1.7.62 is vulnerable to SQL Injection

Software Unite Gallery Lite Type Plugin Vulnerable versions = 1.7.62 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43207 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 6c830f0a9692 Credits João Pedro S Alcântara Kinorth Required privile...

WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Qi Blocks versions = 1.3...

WordPress Magical Posts Display plugin <= 1.2.38 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Magical Posts Display versions = 1.2.38...

WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WPCafe versions = 2.2.27...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.3.8.1...

WordPress AWSM Team – Team Showcase Plugin plugin <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin AWSM Team versions = 1.3.1...

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin PowerPack Lite for Beaver Builder versions = 1.3.0.4...

WordPress Slideshow SE plugin <= 2.5.17 - Author+ Limited Local File Inclusion vulnerability

Author+ Limited Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Slideshow SE versions = 2.5.17...

Ubuntu: Security Advisory (USN-6806-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Emergency Password Reset Plugin <= 8.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Emergency Password Reset Type Plugin Vulnerable versions = 8.0 Fixed in 9.0 OWASP Top 10 A8: Software and Data Integrity Failures Classification Cross Site Request Forgery CSRF CVE CVE-2024-35648 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cd74213ad8d6 Credits...

Intel® PCM Software Advisory

Summary: A potential security vulnerability in some Intel® Performance Counter Monitor PCM software may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-34351 Description: Buffer underflow in some Intel®...

TTS API OS Command Injection Vulnerability

The TTS API is a text-to-speech REST API for multiple TTS engines from the individual developer Pedro Trujillo. An operating system command injection vulnerability exists in TTS API version 2.1.4 and earlier, which stems from the onSpeechDone function of a file that can lead to operating system...

Vulnerability in core server (CVE-2023-5869)

Buffer overrun from integer overflow in array modification While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database...

Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting Vulnerability

Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting Exploit Author: Pedro ISSDU TW Vendor Homepage: https://loganalyzer.adiscon.com/ Software Link: https://loganalyzer.adiscon.com/download/ Version: v4.1.13 and before Tested on: Linux CVE : CVE-2023-36306 There are several...

Cisco UCS-IMC Supervisor 2.2.0.0 Authentication Bypass

Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Date: 08/21/2019 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...

Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass Vulnerability

Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...

GHSA-QRGF-9GPC-VRXW Bypass of CSRF protection in the presence of predictable userInfo

Description The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the use...

pekeUpload cross-site scripting vulnerability

PekeUpload is a Jquery Html5 file upload plugin from the personal developer Pedro Molina in Colombia. pekeUpload suffers from a cross-site scripting vulnerability that exists due to insufficient cleanup of user-supplied data. A remote attacker could exploit the vulnerability to be able to trick a...

MK-AUTH Cross-Site Request Forgery Vulnerability

MK-AUTH is an access control system developed by Pedro Filho, an individual developer in Brazil. A cross-site request forgery vulnerability exists in MK-AUTH through version 19.01 K4.9, which allows passwords to be changed via the central executor central.php. No details of the vulnerability are...

MK-AUTH SQL Injection Vulnerability

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A SQL injection vulnerability exists in the mkt/ PHP script in MK-AUTH version 19.01, which can be exploited by an attacker to execute illegal SQL commands...