CVE-2024-51514

Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-51514

CVE-2024-51514 affects Huawei HarmonyOS VPN module, where a pop-up window attributed to no app can be exploited locally to affect service confidentiality. Documented impact indicates confidentiality risk; no explicit root-cause or patch details are provided across connected sources. Exploitation ...

CVE-2024-38744

Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0...

CVE-2024-38743

CVE-2024-38743 is a WordPress plugin vulnerability in Plum: Spin Wheel & Email Pop-up (Upqode) affecting versions through 2.0. The connected sources describe a Broken Access Control issue (unauthorized access) in Plum: Spin Wheel & Email Pop-up

CVE-2024-38743 WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control vulnerability

Access Control vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows . This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0...

CVE-2024-38744 WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability

Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0...

CVE-2024-38744 WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability

Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0...

CVE-2024-38744

CVE-2024-38744 (Plum: Spin Wheel & Email Pop-up) is tied to Upqode Plum plugin versions n/a through 2.0, with a Missing Authorization vulnerability that enables access to constrained functionality and stores XSS. Public sources indicate unauthenticated access to restricted features and stored XSS...

PT-2024-28188 · Upqode · Upqode Plum: Spin Wheel & Email Pop-Up

Name of the Vulnerable Software and Affected Versions: Upqode Plum: Spin Wheel & Email Pop-up versions n/a through 2.0 Description: The issue affects the Upqode Plum: Spin Wheel & Email Pop-up plugin, allowing access to functionality not properly constrained by ACLs, and stored XSS...

WordPress plugin Plum: Spin Wheel & Email Pop-up 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plug-in. A security vulnerability exists in WordPress...

WordPress plugin Plum: Spin Wheel & Email Pop-up 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plug-in. A security vulnerability exists in WordPress...

PT-2024-28187 · Upqode · Upqode Plum: Spin Wheel & Email Pop-Up

Name of the Vulnerable Software and Affected Versions: Upqode Plum: Spin Wheel & Email Pop-up versions n/a through 2.0 Description: The issue is related to an Access Control vulnerability. It affects the functionality of the software, potentially allowing unauthorized access. Recommendations: For...

CVE-2024-10079

The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajaximportcontent' function. This allows authenticated attackers, with subscriber-level permissions an...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2024-44474)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox that originates from the ability to enumerate external protocol handlers via a pop-up window. No details of the vulnerability are currently available...

CVE-2024-9314

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'setredirections' function. This makes it possible for authenticated attackers, with...

CVE-2024-7433

The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...

CVE-2024-7432

The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...

CVE-2024-7434 UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection

The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...

CVE-2024-7433

CVE-2024-7433 (Empowerment theme for WordPress) is an authenticated object-injection vulnerability. The Empowerment theme (versions ≤ 1.0.2) allows deserialization of untrusted input, enabling attackers with Contributor+ privileges to inject a PHP object. The base vulnerability description notes ...

CVE-2024-7433 Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection

The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...