WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Custom Order Statuses for WooCommerce versions = 1.5.2...

WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control

Software Custom Order Statuses for WooCommerce Type Plugin Vulnerable versions = 1.5.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32524 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6d3c50d7dc4c Credits Abdi...

CVE-2024-2110

The CVE-2024-2110 issue affects the WordPress plugin Events Manager – Calendar, Bookings, Tickets, and more! The Red Hat and Wordfence references confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 6.4.7.1 due to missing/incorrect nonce validation on multiple actions. ...

CVE-2024-25930

Cross-Site Request Forgery CSRF vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2...

CVE-2024-25930

Cross-Site Request Forgery CSRF vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2...

WordPress Plugin Custom Order Statuses for WooCommerce Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Custom Order Statuses for...

CVE-2024-25930

CVE-2024-25930 affects Nuggethon Custom Order Statuses for WooCommerce (plugin

PT-2024-21224 · Woocommerce · Nuggethon Custom Order Statuses For Woocommerce

Name of the Vulnerable Software and Affected Versions: Nuggethon Custom Order Statuses for WooCommerce versions 1.5.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

CVE-2024-1778

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ztdcfcfchangebookmark function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter...

CVE-2024-1778 Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ztdcfcfchangebookmark function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter...

WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Order Statuses for WooCommerce Type Plugin Vulnerable versions = 1.5.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-25930 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2ff127ab6f8c Credits...

WP Job Manager < 2.1.0 - Unauthenticated Job Status Update

Description The plugin does not properly authorize the use of some endpoints, allowing an unauthenticated attacker to update job statuses...

Metform Elementor Contact Form Builder < 3.3.2 - Multiple Subscriber+ Sensitive Information Disclosure Issues

The plugin does not prevent less privileged users, like subscribers, from accessing various sensitive information via the plugin's shortcodes. This includes payment statuses, transaction IDs, submitter's name information, and virtually all fields of any form submissions...

K10630493: Apache Tomcat vulnerability CVE-2018-8020

Security Advisory Description Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists multiple entries of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing...

Malicious code in wm-publish-statuses (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f430aea8d7a18e937f64643aad5fc19a42be349670f884f10161f667367d0483 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site scripting

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

CVE-2022-31136 Cross-site Scripting in BookWyrm

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

GHSA-H742-XX59-R9PQ Mattermost Server exposes sensitive user status information via REST API version 4 endpoint

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...

Mattermost Server exposes sensitive user status information via REST API version 4 endpoint

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...

PT-2022-6498 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 3.5.x through 3.5.2 Description: The issue is related to the undo mark statuses as sensitive method in app/services/approve appeal service.rb, which does not use the server's representative account. This results in moderator...