PT-2024-17583 · WordPress · Wp Ad Guru

Name of the Vulnerable Software and Affected Versions: WP Ad Guru plugin for WordPress versions up to, and including, 2.5.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

PT-2024-36132 · Unknown · Pinpoint Booking System

Name of the Vulnerable Software and Affected Versions: Pinpoint Booking System versions through 2.9.9.5.2 Description: The issue is related to a Missing Authorization vulnerability in the Pinpoint Booking System, allowing exploitation of incorrectly configured access control security levels...

PT-2024-17342 · Unknown +1 · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.12 Description: The issue is related to a missing capability check on the install woocommerce plugin function action, allowing authenticated attackers with Subscriber-lev...

PT-2024-36112 · Unknown · Limit Login Attempts

Name of the Vulnerable Software and Affected Versions: Limit Login Attempts versions n/a through 5.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendation...

PT-2024-36182 · Unknown · Formfacade

Name of the Vulnerable Software and Affected Versions: FormFacade versions 1.3.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in FormFacade. Recommendations: For...

PT-2024-12478 · WordPress · Zippy

Name of the Vulnerable Software and Affected Versions: Zippy versions 1.6.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, also described as a broken access control vulnerability, which affects the Zippy plugin for WordPress. This vulnerability allows...

PT-2024-12921 · Premmerce · Premmerce User Roles

Name of the Vulnerable Software and Affected Versions: Premmerce User Roles versions 1.0.12 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Premmerce User...

PT-2024-36163 · Themeum · Wp Mega Menu

Name of the Vulnerable Software and Affected Versions: WP Mega Menu versions 1.4.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in Themeum WP Mega Menu. Recommendations: For WP Mega Menu versions 1.4.2 and earlier, update to a...

PT-2024-12721 · Onthegosystems · Onthegosystems Language

Name of the Vulnerable Software and Affected Versions: OnTheGoSystems Language versions 1.2.1 and earlier Description: The issue affects the OnTheGoSystems Language, allowing exploitation of incorrectly configured access control security levels due to a missing authorization vulnerability. This...

PT-2024-12456 · Cleantalk · Cleantalk-Spam-Protect

Name of the Vulnerable Software and Affected Versions: CleanTalk Spam Protection versions 6.10 and below Description: The issue is related to a Missing Authorization vulnerability, which allows for broken access control. This can compromise the security of the site. The estimated number of...

CBL Mariner 2.0 Security Update: vim (CVE-2024-47814)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47814 advisory. - Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a...

GHSA-787V-V9VQ-4RGV Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633

CVE-2024-55633 is an Improper Authorization vulnerability in Apache Superset. An attacker with SQLLab access to a PostgreSQL analytic database can craft a SQL DML statement that is incorrectly identified as a read-only query, allowing its execution. The issue does not affect non-PostgreSQL analyt...

CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

Curl 7.76.0 < 8.11.1 Information Disclosure (CVE-2024-11053)

The version of Curl installed on the remote host is between 7.76.0 and prior to 8.11.1. It is, therefore, affected by an information disclosure vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVE...

EulerOS 2.0 SP12 : httpd (EulerOS-SA-2024-2937)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of...

PT-2024-17485 · WordPress · The Hash Form – Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: Hash Form – Drag & Drop Form Builder plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to a missing capability check when creating form styles. This allows authenticated attackers with Contributor-lev...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2024-2968)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of...