WordPress WP Reset Plugin <= 2.01 is vulnerable to Broken Access Control

Software WP Reset Type Plugin Vulnerable versions = 2.01 Fixed in 2.03 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4661 Patch priority Low CVSS severity Low 4.3 Developer WebFactory Ltd. PSID 7f5481b63727 Credits Foxyyy Required privilege Subscriber...

CVE-2024-5438: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attemptdelete' function due to missing validation on a user controlled key. This makes it possible for authenticated...

Fedora: Security Advisory for qt5-qtimageformats (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for qt6-qtdeclarative (FEDORA-2024-bfb8617ba3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress ARForms Plugin < 6.6 is vulnerable to Cross Site Scripting (XSS)

Software ARForms Type Plugin Vulnerable versions 6.6 Fixed in 6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4621 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54c970f6100c Credits Bob Matyas Required privilege...

WordPress SKT Addons for Elementor Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software SKT Addons for Elementor Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5091 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 81d64b5eccce Credits stealthcopter...

Fedora: Security Advisory for rust-uu_fmt (FEDORA-2024-40ee18b2e7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Woody ad snippets Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Woody ad snippets Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35751 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fea34aee9079 Credits savphill Required privilege...

Trend Micro Deep Security Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Deep Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Trend...

WordPress Countdown & Clock Plugin <= 2.7.8 is vulnerable to PHP Object Injection

Software Countdown & Clock Type Plugin Vulnerable versions = 2.7.8 Fixed in 2.7.8.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-2017 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID e293306cdd98 Credits Lucio Sá Required privilege...

WordPress Album and Image Gallery plus Lightbox Plugin <= 2.0 is vulnerable to Broken Access Control

Software Album and Image Gallery plus Lightbox Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4194 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3971913257ef Credits...

CVE-2024-5259: Improper Neutralization of Input During Web Page Generation

The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hoveranimation’ parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it...

WordPress Visualizer Plugin <= 3.11.1 is vulnerable to SQL Injection

Software Visualizer Type Plugin Vulnerable versions = 3.11.1 Fixed in 3.11.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-35736 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a8a01c7cac74 Credits Trương Hữu Phúc truonghuuphuc Required privilege...

WordPress EmbedPress Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software EmbedPress Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5571 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 09e449af3af2 Credits wesley wcraft Required...

WordPress MegaMenu Plugin <= 2.3.12 is vulnerable to Local File Inclusion

Software MegaMenu Type Plugin Vulnerable versions = 2.3.12 Fixed in 2.3.13 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-35677 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 866b59909ea3 Credits Rafie Muhammad Patchstack Required privilege...

BIT-HUBBLE-2024-28250

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's...

SUSE: Security Advisory (SUSE-SU-2024:1271-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : libndp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libndp: buffer overflow flaw in DNS Search List DNSSL handling CVE-2014-3554 Note that Nessus has not tested for th...

RHEL 5 : libnl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libnl: Integer overflow in nlmsgreserve CVE-2017-0553 Note that Nessus has not tested for this issue but has instea...

RHEL 3 : tftp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - tftp: buffer overflow when setting utimeout option CVE-2011-2199 Note that Nessus has not tested for this issue but...