WordPress Formidable Registration Plugin < 2.12 is vulnerable to Broken Authentication

Software Formidable Registration Type Plugin Vulnerable versions 2.12 Fixed in 2.12 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-1290 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID de229a590aad Credits Scott Kingsley Clark...

WordPress Calculated Fields Form Plugin 5.0.0-5.1.56 is vulnerable to Cross Site Scripting (XSS)

Software Calculated Fields Form Type Plugin Vulnerable versions 5.0.0-5.1.56 Fixed in 5.1.57 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2020 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID f60c98fd9fe8 Credits Asaf...

CVE-2020-36780

In the Linux kernel, the following vulnerability has been resolved: i2c: sprd: fix reference leak when pmruntimegetsync fails The PM reference count is not expected to be incremented on return in sprdi2cmasterxfer and sprdi2cremove. However, pmruntimegetsync will increment the PM reference count...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix memory leak in imufmt We are losing the reference to an allocated memory if try. Change the order of the check to avoid that...

CVE-2021-46927

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: Use getuserpagesunlocked call to handle mmap assert After commit 5b78ed24e8ec "mm/pagemap: add mmapassertlocked annotations to findvma", the call to getuserpages will trigger the mmap assert. static inline void...

WordPress Rolo Slider Plugin <= 1.0.9 is vulnerable to Settings Change

Software Rolo Slider Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-1438 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 601d954731d6 Credits Emili Castells Required privilege...

Backstage Security Vulnerabilities

Backstage is a software application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage backend-common, which stems from insufficiently detailed path checking using "resolveSafeChildPath". The vulnerability can be exploited to access files a...

UBUNTU-CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

WordPress WP Setup Wizard Plugin <= 1.0.8.1 is vulnerable to Sensitive Data Exposure

Software WP Setup Wizard Type Plugin Vulnerable versions = 1.0.8.1 Fixed in 1.0.8.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-25917 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 5a05aed5e6cb Credits Dave Jong Patchstack...

WordPress Action Network Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Action Network Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25921 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 24b8e111dbfb Credits Mika Required privilege...

WordPress Knowledge Base for Documentation, FAQs with AI Assistance Plugin <= 11.30.2 is vulnerable to PHP Object Injection

Software Knowledge Base for Documentation, FAQs with AI Assistance Type Plugin Vulnerable versions = 11.30.2 Fixed in 11.31.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24842 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID 6e74033eecde...

WordPress Load More Anything Plugin <= 3.3.3 is vulnerable to Broken Access Control

Software Load More Anything Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24704 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 21a4ab3d4f55 Credits Elliot Required...

WordPress PopupAlly Plugin <= 2.1.0 is vulnerable to Broken Access Control

Software PopupAlly Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-23520 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a577e748f483 Credits Abdi Pranata Required privile...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress WP Go Maps Plugin <= 9.0.28 is vulnerable to Cross Site Scripting (XSS)

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.28 Fixed in 9.0.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6697 Patch priority Medium CVSS severity Medium 7.1 Developer WP Go Maps PSID a5d68fb003d8 Credits Nex Team Required privileg...

2024-01 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5034129)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Malicious code in error-can-not-resolve-resource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f44848c297338de1e97a9c4d961ba8f2441f2464713bd36229bf5c0fb7509455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.8 Fixed in 1.12.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-21747 Patch priority Medium CVSS severity Medium 7.6 Developer Claim ownership PSID bff329846441 Credits Arvandy Required privilege Accounting Manager...

WordPress Booster Plus for WooCommerce Plugin < 7.1.3 is vulnerable to Sensitive Data Exposure

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52230 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 715c035601b4 Credits Dave Jong...

WordPress Booster Plus for WooCommerce Plugin < 7.1.2 is vulnerable to Arbitrary Content Deletion

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.2 Fixed in 7.1.2 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-52232 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c6f3c3864370 Credits Dave Jo...