CVE-2021-32589

CVE-2021-32589 describes a remote, unauthenticated Use-After-Free in the fgfmsd daemon of Fortinet FortiManager and FortiAnalyzer. The flaw in the fgfm port handling (memory after free) allows a non-authenticated attacker to execute arbitrary code with root privileges by sending a crafted request...

CVE-2021-26093

CVE-2021-26093 corresponds to an uninitialized pointer (CWE-824) vulnerability in Fortinet FortiWLC. According to the sources, FortiWLC versions 8.6.0, 8.5.3 and earlier are affected, and a local, authenticated attacker can crash the access point being managed by the controller by issuing a craft...

CVE-2024-35141

CVE-2024-35141 affects IBM Security Verify Access Docker 10.0.0–10.0.6. Root cause: execution of unnecessary privileges enables local privilege escalation. Impact: local attacker could escalate privileges (high). IBM bulletins indicate fixes in 10.0.7/FP0 or later; remediation is to upgrade to th...

CVE-2021-29827

CVE-2021-29827 | IBM InfoSphere Information Server 11.7 suffers a cross-frame scripting (clickjacking) vulnerability. A remote attacker could entice a user to a malicious page to hijack the user’s click actions, potentially enabling further attacks. Affected product/version: InfoSphere Informatio...

CVE-2023-21586

CVE-2023-21586 — Adobe Acrobat Reader : NULL pointer dereference vulnerability affecting versions 22.003.20282 and earlier, 22.003.20281 and earlier, and 20.005.30418 and earlier. An unauthenticated attacker could cause an application denial-of-service, with exploit requiring user interaction (vi...

CVE-2023-41865

CVE-2023-41865 : Slider Pro (WordPress plugin) ≤ 4.8.6 has a Broken Access Control issue where missing authorization on AJAX actions could allow unauthorized access. The vulnerability’s root cause is an insufficient access check on AJAX endpoints. Impact is limited to the affected plugin version ...

CVE-2023-41862

CVE-2023-41862 describes a weak/broken authentication issue in the WordPress plugin VS Contact Form (Very Simple Contact Form) affecting versions up to 14.0. Reported as an authentication abuse vulnerability, the CVE’s base CVSS v3.1 score is 5.3 (Medium). Connected sources indicate the vendor fi...

CVE-2023-41803

CVE-2023-41803 : BitPay Checkout for WooCommerce (WordPress plugin) up to version 4.1.0 is affected by a Broken Access Control vulnerability due to missing authorization checks. The issue allows unauthenticated users to exploit inadequate access configuration to perform unauthorized actions. The ...

CVE-2023-41848

CVE-2023-41848 affects the WordPress Carousel Slider plugin, versions

CVE-2023-41802

CVE-2023-41802 affects WordPress Plugin Super Socializer (Team Heateor) up to version 7.13.54. It is a Missing Authorization / Broken Access Control vulnerability enabling exploitation of improperly configured access control security levels. Public sources in Connected documents confirm affected ...

CVE-2023-41690

CVE-2023-41690: WordPress WiserNotify Social Proof plugin <= 2.5 suffers a Broken Access Control flaw that allows unauthenticated access due to missing authorization checks. The CVE is tracked for WiserNotify Social Proof (WordPress plugin). Connected sources confirm affected versions up to 2....

CVE-2023-41686

CVE-2023-41686: WordPress Woocommerce Support System plugin (versions

CVE-2023-41688

CVE-2023-41688 affects WordPress Bulk NoIndex & NoFollow Toolkit (Mad Fish Digital) up to version 1.5, due to Broken Access Control / Missing Authorization. Public sources list a CVSS v3.1 base score of 5.4 (Medium) with network attack vector and low privileges required. Patchstack notes the fix ...

CVE-2023-41132

CVE-2023-41132 relates to the WordPress plugin Category Slider for WooCommerce (

CVE-2023-39305

CVE-2023-39305 affects the WordPress plugin Yet Another Stars Rating (YASR) up to version 3.4.3, with a Missing Authorization / Broken Access Control issue occurring via the plugin’s init flow. This allows unauthenticated attackers to perform unauthorized actions (e.g., modifying data) on affecte...

CVE-2023-23472

CVE-2023-23472 affects IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7). An authenticated user could obtain sensitive information that could aid further attacks. The vulnerability is described in IBM’s bulletin as an information-disclosure issue with a CVSS v3.1 base sc...

CVE-2023-27428

CVE-2023-27428 affects WordPress WP users media plugin, vulnerable ≤ 4.2.3 due to missing authorization/broken access control. Technical details in connected docs cite a Missing Authorization/CSRF issue on wpusme_save_settings, enabling unauthorized/settings modification for affected users. No pa...

CVE-2023-32117

CVE-2023-32117 affects the WordPress plugin Integrate Google Drive (versions n/a–1.1.99). The root cause is Missing Authorization due to missing capability checks on REST API endpoints, enabling unauthenticated attackers to perform operations (move files, create folders, copy details, etc.). The ...

CVE-2023-32299

CVE-2023-32299 affects the WordPress plugin Ni WooCommerce Sales Report (Ni WooCommerce Sales Report) up to version 3.7.3, due to Missing Authorization / Broken Access Control. Attackers with subscriber-level privileges could exploit an improperly enforced access control to view sales data. The v...

CVE-2023-47762

CVE-2023-47762 affects WordPress BetterDocs plugin up to version 2.5.2, due to Missing Authorization via AJAX actions. Impact: unauthorized modification of documents for authenticated users with subscriber+ privileges (per Patchstack). Mitigation: upgrade to version 2.5.3 or later where fix is ap...