Advisory ROSA-SA-2025-2815

Software: binutils 2.30 OS: ROSA Virtualization 3.0 packageevrstring: binutils-2.30-125.rv30 CVE-ID: CVE-2018-12699 BDU-ID: 2021-01389 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the finishstab function of the stabs.c file of the Binutils program development kit is related to an operation...

Advisory ROSA-SA-2025-2816

Software: openssl 1.1.1k OS: ROSA Virtualization 3.0 packageevrstring: openssl-1.1.1k-14.0.2.rv30 CVE-ID: CVE-2024-5535 BDU-ID: 2024-06988 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SSLselectnextproto function of the SSL toolkit for the TLS and SSL OpenSSL protocols is related to informatio...

WordPress Royal Elementor Addons plugin <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated DOM-Based Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Royal Elementor Addons versions = 1.7.1012...

WordPress Clearfy Cache plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy' vulnerability

Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcrclearfy' vulnerability discovered by Whit Taylor in WordPress Plugin Clearfy Cache versions = 2.3.2...

Advisory ROSA-SA-2025-2787

Software: postgresql15 15.12 OS: rosa-server79 packageevrstring: postgresql15-15.12-1PGDG.res7 CVE-ID: CVE-2024-7348 BDU-ID: 2024-06153 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pgdump utility of the PostgreSQL database management system is related to the dereferencing of a null pointer du...

WordPress WPC Admin Columns plugin 2.0.6-2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update vulnerability

Authenticated Subscriber+ Privilege Escalation via User Meta Update vulnerability discovered by kr0d in WordPress Plugin WPC Admin Columns versions 2.0.6-2.1.0...

WordPress QuadMenu plugin <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update vulnerability

Cross-Site Request Forgery to Limited User Meta Update vulnerability discovered by Peter Thaleikis in WordPress Plugin QuadMenu versions = 3.2.0...

WordPress Cart66 Cloud plugin <= 2.3.7 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Avraham Shemesh in WordPress Plugin Cart66 Cloud versions = 2.3.7...

WordPress Developer Toolbar plugin <= 1.0.3 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Avraham Shemesh in WordPress Plugin Developer Toolbar versions = 1.0.3...

WordPress Everest Forms plugin <= 3.1.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by mikemyers in WordPress Plugin Everest Forms versions = 3.1.1...

WordPress Everest Forms plugin <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin Everest Forms versions = 3.1.1...

WordPress Photo Gallery by 10Web plugin <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter vulnerability

WordPress Photo Gallery by 10Web plugin = 1.8.34 Reflected Cross-Site Scripting via 'imageid' Parameter vulnerability discovered by Ivan Kuzymchak in WordPress Plugin Photo Gallery by 10Web versions = 1.8.34...

WordPress Everest Forms plugin <= 3.1.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by kuaile in WordPress Plugin Everest Forms versions = 3.1.1...

WordPress Z Companion plugin <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Z Companion versions = 1.1.1...

WordPress Cost Calculator Builder plugin <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter vulnerability

Authenticated Subscriber+ SQL Injection via orderids Parameter vulnerability discovered by mikemyers in WordPress Plugin Cost Calculator Builder versions = 3.2.67...

WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Booking and Rental Manager versions = 2.2.8...

WordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin Real Testimonials versions = 3.1.6...

WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin Uncanny Toolkit for LearnDash versions = 3.7.0.1...

WordPress SKT Skill Bar plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin SKT Skill Bar versions = 2.3...

WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Kargo Entegratör versions = 1.1.14...