Backstage Security Vulnerabilities

Backstage is a software application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage backend-common, which stems from insufficiently detailed path checking using "resolveSafeChildPath". The vulnerability can be exploited to access files a...

UBUNTU-CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

WordPress WP Setup Wizard Plugin <= 1.0.8.1 is vulnerable to Sensitive Data Exposure

Software WP Setup Wizard Type Plugin Vulnerable versions = 1.0.8.1 Fixed in 1.0.8.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-25917 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 5a05aed5e6cb Credits Dave Jong Patchstack...

WordPress Action Network Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Action Network Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25921 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 24b8e111dbfb Credits Mika Required privilege...

WordPress Knowledge Base for Documentation, FAQs with AI Assistance Plugin <= 11.30.2 is vulnerable to PHP Object Injection

Software Knowledge Base for Documentation, FAQs with AI Assistance Type Plugin Vulnerable versions = 11.30.2 Fixed in 11.31.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24842 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID 6e74033eecde...

WordPress Load More Anything Plugin <= 3.3.3 is vulnerable to Broken Access Control

Software Load More Anything Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24704 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 21a4ab3d4f55 Credits Elliot Required...

WordPress PopupAlly Plugin <= 2.1.0 is vulnerable to Broken Access Control

Software PopupAlly Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-23520 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a577e748f483 Credits Abdi Pranata Required privile...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress WP Go Maps Plugin <= 9.0.28 is vulnerable to Cross Site Scripting (XSS)

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.28 Fixed in 9.0.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6697 Patch priority Medium CVSS severity Medium 7.1 Developer WP Go Maps PSID a5d68fb003d8 Credits Nex Team Required privileg...

2024-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5034129)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Malicious code in error-can-not-resolve-resource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f44848c297338de1e97a9c4d961ba8f2441f2464713bd36229bf5c0fb7509455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.8 Fixed in 1.12.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-21747 Patch priority Medium CVSS severity Medium 7.6 Developer Claim ownership PSID bff329846441 Credits Arvandy Required privilege Accounting Manager...

WordPress Booster Plus for WooCommerce Plugin < 7.1.3 is vulnerable to Sensitive Data Exposure

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52230 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 715c035601b4 Credits Dave Jong...

WordPress Booster Plus for WooCommerce Plugin < 7.1.2 is vulnerable to Arbitrary Content Deletion

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.2 Fixed in 7.1.2 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-52232 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c6f3c3864370 Credits Dave Jo...

WordPress WooCommerce Warranty Requests Plugin <= 2.2.7 is vulnerable to Broken Access Control

Software WooCommerce Warranty Requests Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51496 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID d88a3c131398 Credits Rafie...

WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

WordPress Backup Migration Plugin 1.0.8-1.3.9 is vulnerable to Remote File Inclusion

Software Backup Migration Type Plugin Vulnerable versions 1.0.8-1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Remote File Inclusion CVE CVE-2023-6971 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e70590c9be58 Credits NP3228 - NFlabs...

WordPress Product Filter by WBW Plugin <= 2.5.0 is vulnerable to Broken Access Control

Software Product Filter by WBW Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50877 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b4377cfc0c43 Credits Abdi Pranata...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.1.5 is vulnerable to Broken Access Control

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50884 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 0dcf79343479 Credits thiennv...

WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Type Theme Vulnerable versions = 5.9.1 Fixed in 5.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50892 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e038c2e19876 Credits Rafie Muhammad Patchstack Required privile...