CVE-2024-3664 Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting

The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setthumbnail and deletethumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with...

CVE-2024-3664

CVE-2024-3664 affects the Quick Featured Images plugin for WordPress. The vulnerability is due to a missing capability check in set_thumbnail and delete_thumbnail, affecting all versions up to 13.7.0. It allows authenticated attackers with contributor level access or higher to delete thumbnails a...

CVE-2024-3664 Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting

The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setthumbnail and deletethumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with...

WordPress Quick Featured Images plugin <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Thumbnail Deletion/Setting vulnerability discovered by Lucio Sá in WordPress Plugin Quick Featured Images versions = 13.7.0...

PT-2024-24156 · Unknown · Rg-Rsr10-01G-T(Wa)-S

Name of the Vulnerable Software and Affected Versions: RG-RSR10-01G-TW-S and RG-RSR10-01G-TWA-S routers version RSR10-01G-T-S RSR 3.01B9P2, Release07150910 Description: An issue in the routers allows attackers to execute arbitrary code via the common quick config.lua file. Recommendations: For...

Ruijie Networks RG-RSR10-01G-T 安全漏洞

The Ruijie Networks RG-RSR10-01G-T is a wireless router from Ruijie Networks China. A security vulnerability exists in the RG-RSR10-01G-TW-S and RG-RSR10-01G-TWA-S, which originated from a vulnerability that allows an attacker to execute arbitrary code via the commonquickconfig.loa file. Affected...

PT-2024-27104

Name of the Vulnerable Software and Affected Versions Quick Featured Images plugin for WordPress versions up to, and including, 13.7.0 Description The issue allows authenticated attackers with contributor-level access and above to modify data without authorization. This is due to a missing...

CVE-2024-3664: Missing Authorization

The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setthumbnail and deletethumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with...

WordPress plugin Quick Featured Images 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

quic-go Resource Leak DoS

The vulnerability of the QUIC protocol implementation in the quic-go library written in the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2024-26836

Name of the Vulnerable Software and Affected Versions The Poll Maker – Best WordPress Poll Plugin versions up to, and including, 5.1.8 Description The issue is related to Stored Cross-Site Scripting due to a missing capability check on the ays poll maker quick start AJAX action, as well as...

PT-2024-27911

Name of the Vulnerable Software and Affected Versions Quick Share versions prior to 1.0.1724.0 Description The issue allows an attacker to bypass the accept file dialog on Quick Share Windows. Normally, the Quick Share Windows app requires user acceptance from the receiving device to send a file...

PT-2024-27910 · Unknown · Quick Share

Name of the Vulnerable Software and Affected Versions: Quick Share versions prior to 1.0.1724.0 Description: There exists an issue in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a...

WordPress WPC Smart Quick View for WooCommerce plugin <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Ulyses Saicha in WordPress Plugin WPC Smart Quick View for WooCommerce versions = 4.0.2...

WordPress Plugin WPC Smart Quick View for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-6494: Improper Neutralization of Input During Web Page Generation

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

New Wave of JSOutProx Malware Targeting Financial Firms in APAC and MENA

Financial organizations in the Asia-Pacific APAC and Middle East and North Africa MENA are being targeted by a new version of an "evolving threat" called JSOutProx. "JSOutProx is a sophisticated attack framework utilizing both JavaScript and .NET," Resecurity said in a technical report published...

WordPress Loan Repayment Calculator and Application Form plugin <= 2.9.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Skalucy Patchstack Alliance in WordPress Plugin Quick Interest Slider versions = 2.9.4...

Quick CMS v6.7 en 2023 - (password) SQL injection Vulnerability

Title: Quick CMS v6.7 en 2023 - 'password' SQLi Author: nu11secur1ty Vendor: https://opensolution.org/ Software: https://opensolution.org/download/home.html?sFile=Quick.Cmsv6.7-en.zip Reference: https://portswigger.net/web-security/sql-injection Description: The password parameter is vulnerable f...

Quick CMS v6.7 en 2023 - &#039;password&#039; SQLi

Title: Quick CMS v6.7 en 2023 - 'password' SQLi Author: nu11secur1ty Date: 03/19/2024 Vendor: https://opensolution.org/ Software: https://opensolution.org/download/home.html?sFile=Quick.Cmsv6.7-en.zip Reference: https://portswigger.net/web-security/sql-injection Description: The password paramete...