WordPress Sendinblue for WooCommerce Plugin <= 4.0.17 is vulnerable to Arbitrary File Download

Software Sendinblue for WooCommerce Type Plugin Vulnerable versions = 4.0.17 Fixed in 4.0.18 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32807 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 1a6d8c4d6ed3 Credits Yudistira Arya...

WordPress SuperFaktura WooCommerce Plugin <= 1.40.3 is vulnerable to Server Side Request Forgery (SSRF)

Software SuperFaktura WooCommerce Type Plugin Vulnerable versions = 1.40.3 Fixed in 1.40.4 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-32803 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 1f6825e0241f Credits...

WordPress Debug Log Manager Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Debug Log Manager Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-32582 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1f92fe55cb9f Credits Majed Refaea Required...

WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.3 is vulnerable to Broken Access Control

Software Barcode Scanner with Inventory & Order Manager Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32589 Patch priority Medium CVSS severity Medium 7.1 Developer DMitry PSID 1f47371c73ec Credits...

WordPress WP Poll Maker Plugin <= 3.4 is vulnerable to Arbitrary File Upload

Software WP Poll Maker Type Plugin Vulnerable versions = 3.4 Fixed in 3.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-32514 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 5f238f52b673 Credits Yudistira Arya Required privilege Subscriber...

WordPress WP Cost Estimation & Payment Forms Builder Plugin <= 10.1.76 is vulnerable to Broken Access Control

Software WP Cost Estimation & Payment Forms Builder Type Plugin Vulnerable versions = 10.1.76 Fixed in 10.1.77 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32509 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4f90762b9976...

WordPress Podlove Podcast Publisher Plugin <= 4.1.0 is vulnerable to Broken Access Control

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.1.0 Fixed in 4.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32143 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID fc4ae0b13cd1 Credits Abdi Pranata...

CVE-2021-47206

In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platformgetresource It will cause null-ptr-deref if platformgetresource returns NULL, we need check the return value...

GHSA-V4MM-Q8FV-R2W5 WildFly Elytron: SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

WordPress Post Type Builder (PTB) Plugin < 2.1.4 is vulnerable to Content Injection

Software Post Type Builder PTB Type Plugin Vulnerable versions 2.1.4 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2024-31366 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 60019a0448c7 Credits Dave Jong Patchstack...

nodejs: path traversal by monkey-patching buffer internals

A flaw was found in Node.js. The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a buffer, the implementation uses Buffer.from to obtain a buffer from the result of path.resolve. By...

WordPress WP Poll Maker Plugin <= 3.1 is vulnerable to Arbitrary File Deletion

Software WP Poll Maker Type Plugin Vulnerable versions = 3.1 Fixed in 3.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-31240 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 371f80c25178 Credits Yudistira Arya Required privile...

WordPress WP Photo Album Plus Plugin < 8.6.03.005 is vulnerable to Arbitrary File Upload

Software WP Photo Album Plus Type Plugin Vulnerable versions 8.6.03.005 Fixed in 8.6.03.005 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31286 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b5fb22d21826 Credits stealthcopter Required...

WordPress Product Designer Plugin <= 1.0.32 is vulnerable to PHP Object Injection

Software Product Designer Type Plugin Vulnerable versions = 1.0.32 Fixed in 1.0.33 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-31277 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID c28d30a48452 Credits Yudistira Arya Required privilege...

CVE-2024-26757 md: Don't ignore read-only array in md_check_recovery()

In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in mdcheckrecovery Usually if the array is not read-write, mdcheckrecovery won't register new syncthread in the first place. And if the array is read-write and syncthread is registered,...

WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.7 is vulnerable to Broken Access Control

Software Shortcodes and extra features for Phlox theme Type Plugin Vulnerable versions = 2.15.7 Fixed in 2.15.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31099 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 6820fd10e35f...

WordPress New Order Notification for Woocommerce Plugin <= 2.0.2 is vulnerable to Broken Access Control

Software New Order Notification for Woocommerce Type Plugin Vulnerable versions = 2.0.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31098 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f43459ca9b98 Credits...

WordPress Add Shortcodes Actions And Filters Plugin <= 2.10 is vulnerable to Cross Site Scripting (XSS)

Software Add Shortcodes Actions And Filters Type Plugin Vulnerable versions = 2.10 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30558 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8a48b95c13c Credits Dimas Maulana...

WordPress SpiderFAQ Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software SpiderFAQ Type Plugin Vulnerable versions = 1.3.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31123 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b1bbca771587 Credits Dimas Maulana Required privilege...

WordPress Woocommerce Social Media Share Buttons Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Social Media Share Buttons Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31109 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2941fe56e84a Credits Dimas Maula...