TYPO3 Security Misconfiguration in Frontend Session Handling

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...

GHSA-82VP-JR39-4J2J TYPO3 Security Misconfiguration in Frontend Session Handling

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...

GHSA-XMGR-JFF3-FCFV TYPO3 Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

GHSA-RXC9-F2X6-QH4W TYPO3 Security Misconfiguration for Backend User Accounts

When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...

TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

WordPress Atarim Plugin <= 3.22.6 is vulnerable to Other Vulnerability Type

Software Atarim Type Plugin Vulnerable versions = 3.22.6 Fixed in 3.30 OWASP Top 10 A5: Security Misconfiguration Classification Other Vulnerability Type CVE CVE-2024-2038 Patch priority High CVSS severity High 7.5 Developer Atarim PSID 62433e90ed84 Credits Lucio Sá Required privilege...

WordPress Debug Log – Manger Tool Plugin <= 1.4.5 is vulnerable to Sensitive Data Exposure

Software Debug Log – Manger Tool Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-34798 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 669450ad8391 Credits emad Required...

GHSA-XCP4-62VJ-CQ3R @valtimo/components exposes access token to form.io

Impact When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is...

WordPress Easy Digital Downloads Plugin <= 3.2.11 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.11 Fixed in 3.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c5d829b14d8d Credits Dhabaleshwar D...

WordPress WTI Like Post Plugin <= 1.4.6 is vulnerable to Bypass Vulnerability

Software WTI Like Post Type Plugin Vulnerable versions = 1.4.6 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-33917 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 2def3782f557 Credits Mika Required privilege...

WordPress Smart Maintenance Mode Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart Maintenance Mode Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-33638 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 65450ffbae04 Credits LeNgocHoa...

WordPress WP Travel Engine Plugin <= 5.8.0 is vulnerable to Broken Access Control

Software WP Travel Engine Type Plugin Vulnerable versions = 5.8.0 Fixed in 5.8.1 OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2024-32798 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 429c915534c2 Credits Ananda Dhakal Patchstack...

WordPress Royal Elementor Addons Plugin <= 1.3.93 is vulnerable to Bypass Vulnerability

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.93 Fixed in 1.3.95 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32786 Patch priority Low CVSS severity Low 5.3 Developer WProyal PSID 136b421b7f6f Credits Brandon Roldan Required...

WordPress Maintenance Mode by helderk Plugin <= 3.0.1 is vulnerable to Bypass Vulnerability

Software Maintenance Mode by helderk Type Plugin Vulnerable versions = 3.0.1 Fixed in 3.0.2 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32708 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID f7a912992b4c Credits LeNgocHoa...

WordPress BP Better Messages Plugin <= 2.4.32 is vulnerable to Broken Authentication

Software BP Better Messages Type Plugin Vulnerable versions = 2.4.32 Fixed in 2.4.33 OWASP Top 10 A5: Security Misconfiguration Classification Broken Authentication CVE CVE-2024-32802 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID f9f66260d562 Credits Ananda Dhakal...

WordPress weForms Plugin <= 1.6.20 is vulnerable to Bypass Vulnerability

Software weForms Type Plugin Vulnerable versions = 1.6.20 Fixed in 1.6.21 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32512 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID afd56fb1f506 Credits Kyle Sanchez Required privilege...

WordPress Zero Spam Plugin <= 5.5.6 is vulnerable to Bypass Vulnerability

Software Zero Spam Type Plugin Vulnerable versions = 5.5.6 Fixed in 5.5.7 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-32521 Patch priority Low CVSS severity Low 5.3 Developer Highfivery PSID 22cfce837443 Credits Brandon Roldan Required privilege...

WordPress Product Feed PRO for WooCommerce Plugin <= 13.3.1 is vulnerable to Sensitive Data Exposure

Software Product Feed PRO for WooCommerce Type Plugin Vulnerable versions = 13.3.1 Fixed in 13.3.2 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32513 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 20d6ccb380e3 Credits...

SAP NetWeaver Authorization Issues Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. SAP NetWeaver has an authorization issue vulnerability that stems from a security misconfiguration in the...

WordPress GEO my WordPress Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.1 Fixed in 4.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32097 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fbcae2de410d Credits thiennv Required...