Oracle Linux 9 : containernetworking-plugins (ELSA-2024-9089)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9089 advisory. - rebuild for CVE-2024-24791 - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2024-52304 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2024-52304 Source...

Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security

wordpress-really-simple-security-authn-bypass-vulnerable-appli...

Really Simple Security Free Privilege Escalation

The vulnerabilities of the Really Simple Security Free, Really Simple Security Pro, and Really Simple Security Pro Multisite plugins of the WordPress content management system are related to authentication process flaws. Exploiting these vulnerabilities can allow attackers to increase their...

Exploit for Missing Authorization in Wpxpo Postx

CVE-2024-10728 PostX = 4.1.16 - Missing Authorization to A...

RHSA-2024:9089 Red Hat Security Advisory: containernetworking-plugins security update

Bulletin has no description...

CVE-2024-9529

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privile...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

CVE-2024-10924

The Really Simple Security WordPress plugin (versions 9.0.0 to 9.1.1.1) is vulnerable to an authentication bypass due to improper user check error handling in the check_login_and_get_user function during two-factor REST API actions. When Two-Factor Authentication is enabled, unauthenticated attac...

PT-2024-16350

Name of the Vulnerable Software and Affected Versions WP Chat App plugin for WordPress versions up to, and including, 3.6.8 Description The issue arises from a missing capability check on the ajax install plugin function, allowing authenticated attackers with Subscriber-level access and above to...

MAL-2024-10762 Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in multi-module-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aff0b4072fc406f1d6cf7be27b624904d2db63d968a2f00b56a7ef6db5ad7e3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

containernetworking-plugins security update

1:1.5.1-2 - rebuild for CVE-2024-24791 - Resolves: RHEL-47166 1:1.5.1-1 - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1 - Related: RHEL-27608 1:1.5.0-1 - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0 - Related: RHEL-27608 1:1.4.1-1 -...

VulnCheck KEV: CVE-2024-10924

The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'checkloginandgetuser' function. This makes it possible...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.12-beta-2), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.12-beta-2) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.12-beta-2)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.12-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.12-beta-2 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.10) +2 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.10)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.10 -...

Wrap Up the Year with the Biggest Scope and Rewards Yet: Join the Wordfence Bug Bounty Program End of Year Holiday Extravaganza!

The holidays are here, and so is your chance to earn big while helping secure the WordPress ecosystem! For all submissions to our Bug Bounty Program from November 12, 2024, to December 9, 2024 , we’re rolling out our End of Year Holiday Extravaganza promotion to give back to our security...

Jenkins plugins Multiple Vulnerabilities (2024-11-13)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform...