AutoCMS 安全漏洞

AutoCMS is a content management system CMS from AutoCMS Open Source. It can help dealerships manage their website content, online advertising, social media and analytics. AutoCMS version 5.4 suffers from a SQL injection vulnerability that originates from the lack of validation of externally enter...

WordPress WP Cerber Security plugin <= 9.4 - IP Protection Bypass vulnerability

IP Protection Bypass vulnerability discovered by chihyu in WordPress Plugin WP Cerber Security versions = 9.4...

WordPress Parabola theme <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Parabola versions = 2.4.1...

B&R Industrial Automation APROL 安全漏洞

B&R Industrial Automation APROL is a production process management system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation APROL R version 4.4-00P3 and prior versions that stems from the inclusion of an untrusted search path vulnerability...

Magento Improper Authorization leads to Security feature bypass

Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...

Drupal View Password module < 6.0.4 - Administrator+ Cross Site Scripting (XSS) vulnerability

Administrator+ Cross Site Scripting XSS vulnerability discovered by Ide Braakman in WordPress Module View Password versions 6.0.4...

Bylancer Quicklancer SQL注入漏洞

Bylancer Quicklancer is a freelance platform from Bylancer, Inc. A SQL injection vulnerability exists in Bylancer Quicklancer version 2.4, which stems from the parameter range2 of the component GET Parameter Handler can lead to SQL injection...

UBUNTU-CVE-2024-21176

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Thread Pooling. Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Church Admin versions = 4.4.4...

WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Church Admin versions = 4.4.4...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.4.0...

IBM Db2 安全漏洞

IBM Db2 is a relational database management system from International Business Machines IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. A user enumeration vulnerability exists in IBM Db2 for i versions 7.2, 7.3, 7.4, and 7.5, which stems...

CVE-2024-32705

Missing Authorization vulnerability in reputeinfosystems ARForms.This issue affects ARForms: from n/a through 6.4...

CVE-2024-5449

The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdmsocialsharesaveoptions function in all versions up to, and...

WordPress Weaver Xtreme Theme Support plugin <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via div Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Weaver Xtreme Theme Support versions = 6.4...

CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2023-44247

A double free vulnerability CWE-415 vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests...

PT-2024-19884 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector on MacOS versions prior to 3.4 Description: An issue with improper validation of integrity check values in the upgrade process may allow local execution of code. This issue is related to the Zscaler Client Connector o...

PT-2024-24793

Name of the Vulnerable Software and Affected Versions Repute info systems ARForms versions n/a through 6.4 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin ARForms versions = 6.4...