WordPress FooGallery Plugin <= 2.4.14 is vulnerable to Cross Site Scripting (XSS)

Software FooGallery Type Plugin Vulnerable versions = 2.4.14 Fixed in 2.4.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2471 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ca4e1f65de9f Credits Tim Coen Required privilege...

WordPress WP-Stateless Plugin <= 3.4.0 is vulnerable to Broken Access Control

Software WP-Stateless Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1385 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 12374ce1567e Credits Krzysztof Zając Required...

Vulnerabilities Exposed Hugging Face to AI Supply Chain Attacks

By Deeba Ahmed Wiz.io, known for its cloud security expertise, and Hugging Face, a leader in open-source AI tools, are combining their knowledge to develop solutions that address these security concerns. This collaboration signifies a growing focus on securing the foundation of AI advancements...

WordPress WP Poll Maker Plugin <= 3.1 is vulnerable to Arbitrary File Deletion

Software WP Poll Maker Type Plugin Vulnerable versions = 3.1 Fixed in 3.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-31240 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 371f80c25178 Credits Yudistira Arya Required privile...

WordPress ARForms Form Builder Plugin <= 1.6.1 is vulnerable to Broken Access Control

Software ARForms Form Builder Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31270 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 4ca59fc15641 Credits Yudistira Arya Require...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Local File Inclusion

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-31300 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 770673a69613 Credits Rafie Muhammad Patchstack Required...

WordPress Church Admin Plugin <= 4.1.6 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.6 Fixed in 4.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31281 Patch priority Medium CVSS severity Medium 6.3 Developer Andy Moyle PSID 45a702e240da Credits Peng Zhou Required privilege...

WordPress WordPress Gallery Exporter Plugin <= 1.3 is vulnerable to Arbitrary File Download

Software WordPress Gallery Exporter Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-31342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6307ae9c3c1f Credits Abdi Prawira Negara...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Broken Access Control

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31307 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 88c85a953f3f Credits Rafie Muhammad...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31304 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 245d71ae2d23 Credits LVT-tholv2k Required...

CVE-2024-2868: Improper Neutralization of Input During Web Page Generation

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems parameter in the WL Special Day Offer Widget in all versions up to, and including, 2.8.3 due to...

U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers

The U.S. Cyber Safety Review Board CSRB has criticized Microsoft for a series of security lapses that led to the breach of nearly two dozen companies across Europe and the U.S. by a China-based nation-state group called Storm-0558 last year. The findings, released by the Department of Homeland...

CVE-2024-26719 nouveau: offload fence uevents work to workqueue

In the Linux kernel, the following vulnerability has been resolved: nouveau: offload fence uevents work to workqueue This should break the deadlock between the fctx lock and the irq lock. This offloads the processing off the work from the irq into a workqueue...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.17 Fixed in 3.2.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0598 Patch priority Low CVSS severity Low 5.9 Developer KadenceWP PSID def3561720ef Credits Akbar...

Fedora: Security Advisory (FEDORA-2024-b458482d48)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress My Calendar Plugin < 3.4.24 is vulnerable to Cross Site Scripting (XSS)

Software My Calendar Type Plugin Vulnerable versions 3.4.24 Fixed in 3.4.24 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1274 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fa4438f7ecbf Credits cyc707 Required...

WordPress Template Kit – Import Plugin <= 1.0.14 is vulnerable to Cross Site Scripting (XSS)

Software Template Kit – Import Type Plugin Vulnerable versions = 1.0.14 Fixed in 1.0.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2334 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3ba95df4bab0 Credits Colin Xu Require...

WordPress MasterStudy LMS Plugin <= 3.3.0 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2411 Patch priority High CVSS severity High 9 Developer Claim ownership PSID c509d4c43d0b Credits Hiroho Shimada Required privilege...

CVE-2024-30561

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scientech It Solution Appointment Calendar allows Reflected XSS.This issue affects Appointment Calendar: from n/a through 2.9.6...

CVE-2024-30561 WordPress Appointment Calendar plugin <= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scientech It Solution Appointment Calendar allows Reflected XSS.This issue affects Appointment Calendar: from n/a through 2.9.6...