TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

WordPress Atarim Plugin <= 3.22.6 is vulnerable to Other Vulnerability Type

Software Atarim Type Plugin Vulnerable versions = 3.22.6 Fixed in 3.30 OWASP Top 10 A5: Security Misconfiguration Classification Other Vulnerability Type CVE CVE-2024-2038 Patch priority High CVSS severity High 7.5 Developer Atarim PSID 62433e90ed84 Credits Lucio Sá Required privilege...

WordPress Debug Log – Manger Tool Plugin <= 1.4.5 is vulnerable to Sensitive Data Exposure

Software Debug Log – Manger Tool Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-34798 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 669450ad8391 Credits emad Required...

GHSA-XCP4-62VJ-CQ3R @valtimo/components exposes access token to form.io

Impact When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is...

WordPress Easy Digital Downloads Plugin <= 3.2.11 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.11 Fixed in 3.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c5d829b14d8d Credits Dhabaleshwar D...

WordPress WTI Like Post Plugin <= 1.4.6 is vulnerable to Bypass Vulnerability

Software WTI Like Post Type Plugin Vulnerable versions = 1.4.6 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-33917 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 2def3782f557 Credits Mika Required privilege...

WordPress Smart Maintenance Mode Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart Maintenance Mode Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-33638 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 65450ffbae04 Credits LeNgocHoa...

WordPress WP Travel Engine Plugin <= 5.8.0 is vulnerable to Broken Access Control

Software WP Travel Engine Type Plugin Vulnerable versions = 5.8.0 Fixed in 5.8.1 OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2024-32798 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 429c915534c2 Credits Ananda Dhakal Patchstack...

WordPress Maintenance Mode by helderk Plugin <= 3.0.1 is vulnerable to Bypass Vulnerability

Software Maintenance Mode by helderk Type Plugin Vulnerable versions = 3.0.1 Fixed in 3.0.2 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32708 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID f7a912992b4c Credits LeNgocHoa...

WordPress Royal Elementor Addons Plugin <= 1.3.93 is vulnerable to Bypass Vulnerability

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.93 Fixed in 1.3.95 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32786 Patch priority Low CVSS severity Low 5.3 Developer WProyal PSID 136b421b7f6f Credits Brandon Roldan Required...

WordPress BP Better Messages Plugin <= 2.4.32 is vulnerable to Broken Authentication

Software BP Better Messages Type Plugin Vulnerable versions = 2.4.32 Fixed in 2.4.33 OWASP Top 10 A5: Security Misconfiguration Classification Broken Authentication CVE CVE-2024-32802 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID f9f66260d562 Credits Ananda Dhakal...

WordPress Product Feed PRO for WooCommerce Plugin <= 13.3.1 is vulnerable to Sensitive Data Exposure

Software Product Feed PRO for WooCommerce Type Plugin Vulnerable versions = 13.3.1 Fixed in 13.3.2 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32513 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 20d6ccb380e3 Credits...

WordPress weForms Plugin <= 1.6.20 is vulnerable to Bypass Vulnerability

Software weForms Type Plugin Vulnerable versions = 1.6.20 Fixed in 1.6.21 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32512 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID afd56fb1f506 Credits Kyle Sanchez Required privilege...

WordPress Zero Spam Plugin <= 5.5.6 is vulnerable to Bypass Vulnerability

Software Zero Spam Type Plugin Vulnerable versions = 5.5.6 Fixed in 5.5.7 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32521 Patch priority Low CVSS severity Low 5.3 Developer Highfivery PSID 22cfce837443 Credits Brandon Roldan Required privilege...

SAP NetWeaver Authorization Issues Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. SAP NetWeaver has an authorization issue vulnerability that stems from a security misconfiguration in the...

WordPress Kimili Flash Embed Plugin <= 2.5.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Kimili Flash Embed Type Plugin Vulnerable versions = 2.5.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32092 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0aaaa2adc731 Credits Nguyen Xuan...

WordPress GEO my WordPress Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.1 Fixed in 4.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32097 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fbcae2de410d Credits thiennv Required...

WordPress Table & Contact Form 7 Database – Tablesome Plugin <= 1.0.25 is vulnerable to Cross Site Request Forgery (CSRF)

Software Table & Contact Form 7 Database – Tablesome Type Plugin Vulnerable versions = 1.0.25 Fixed in 1.0.26 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31388 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Login with phone number Plugin <= 1.6.93 is vulnerable to Cross Site Request Forgery (CSRF)

Software Login with phone number Type Plugin Vulnerable versions = 1.6.93 Fixed in 1.6.94 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31424 Patch priority Low CVSS severity Low 8.8 Developer Hamid Alinia PSID 32dbb4921861 Credits Majed...

CVE-2024-27899 Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both...