CVE-2024-51657

CVE-2024-51657 affects WordPress SmartLink Dynamic URLs plugin (versions up to 1.1.0). Root cause: CSRF that can lead to Stored XSS. Impact per CVSS: HIGH (7.1). Exploitation requires unauthenticated access; user interaction is not necessarily needed for CSRF, but the stored XSS effect can occur ...

CVE-2024-51657 WordPress SmartLink Dynamic URLs plugin <= 1.1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw. The software includes ConfigProvider plugins, specifically FileConfigProvider , DirectoryConfigProvider , and EnvVarConfigProvider , which allow reading from the disk or ...

CVE-2024-51657: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through = 1.1.0...

PT-2024-34801

Name of the Vulnerable Software and Affected Versions Woopy Plugins SmartLink Dynamic URLs versions 1.1.0 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Woopy Plugins SmartLink Dynamic URLs. Recommendations For versions 1.1.0 and...

Oracle Linux 9 : containernetworking-plugins (ELSA-2024-9089)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9089 advisory. - rebuild for CVE-2024-24791 - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723...

RockyLinux 8 : gstreamer1-plugins-base (RLSA-2024:9056)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:9056 advisory. gstreamer: EXIF Metadata Parsing Integer Overflow CVE-2024-4453 Tenable has extracted the preceding description block directly from the RockyLinux security...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-52304 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-52304 Source...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

wordpress-really-simple-security-authn-bypass-vulnerable-appli...

Really Simple Security Free Privilege Escalation

The vulnerabilities of the Really Simple Security Free, Really Simple Security Pro, and Really Simple Security Pro Multisite plugins of the WordPress content management system are related to authentication process flaws. Exploiting these vulnerabilities can allow attackers to increase their...

Exploit for Missing Authorization in Wpxpo Postx

CVE-2024-10728 PostX = 4.1.16 - Missing Authorization to A...

RHSA-2024:9089 Red Hat Security Advisory: containernetworking-plugins security update

Bulletin has no description...

CVE-2024-9529

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privile...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security WordPress plugin (versions 9.0.0 to 9.1.1.1) is vulnerable to an authentication bypass due to improper user check error handling in the check_login_and_get_user function during two-factor REST API actions. When Two-Factor Authentication is enabled, unauthenticated attac...

PT-2024-16350

Name of the Vulnerable Software and Affected Versions WP Chat App plugin for WordPress versions up to, and including, 3.6.8 Description The issue arises from a missing capability check on the ajax install plugin function, allowing authenticated attackers with Subscriber-level access and above to...

MAL-2024-10762 Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...