CVE-2024-1279

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

Code injection

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

Design/Logic Flaw

The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts...

CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2024-1290

The User Registration WordPress plugin (specifically the Formidable Registration plugin) versions prior to 2.12 contains a Broken Authentication vulnerability. This flaw allows users with at least the contributor role to render sensitive shortcodes, which can be used to generate and leak valid pa...

CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2024-1279

The CVE-2024-1279 vulnerability affects the Paid Memberships Pro WordPress plugin prior to version 2.12.9. The issue allows users with at least the contributor role to disclose other users’ sensitive metadata, exposing confidentiality. Root cause details indicate insufficient access controls for ...

CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2024-1273 Starbox < 3.5.0 - Contributor+ Stored XSS

The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-1273 Starbox < 3.5.0 - Contributor+ Stored XSS

The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-1279: Undefined Security Weakness

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

PT-2024-18205

Name of the Vulnerable Software and Affected Versions The Grid Shortcodes WordPress plugin versions prior to 1.1.1 Description The issue concerns the Grid Shortcodes WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page or post...

CVE-2024-1273: Improper Neutralization of Input During Web Page Generation

The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

PT-2024-17740 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro WordPress plugin versions prior to 2.12.9 Description: The issue allows users with at least the contributor role to leak other users' sensitive metadata. Recommendations: For versions prior to 2.12.9, update to version...

Improper Authorization

GitLab is vulnerable to Improper Authorization. The vulnerability is due to a privilege escalation flaw in GitLab. Users with a custom role of managegroupaccesstokens could rotate group access tokens with owner privileges, allowing them to escalate their privileges within the system...

FreeBSD : Gitlab -- Vulnerabilities (b2caae55-dc38-11ee-96dc-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b2caae55-dc38-11ee-96dc-001b217b3468 advisory. - An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior...

CVE-2024-1299

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of managegroupaccesstokens to rotate group access tokens with owner privileges...

CVE-2024-1299 Privilege Chaining in GitLab

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of managegroupaccesstokens to rotate group access tokens with owner privileges...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab, which stems from an elevation of...

CVE-2024-27915 Sulu grants access to pages regardless of role permissions

Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The...