2875 matches found
CVE-2024-50356
CVE-2024-50356 affects Press, a Frappe custom app (used with Frappe Cloud) that manages infrastructure, subscriptions and SaaS. The issue allows password resets by anyone with access to a user’s email inbox, circumventing 2FA, though logging in remains blocked for users who have 2FA enabled. A pa...
CVE-2024-9629 Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with...
CVE-2024-9629 Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with...
WordPress Contact Form 7 Telegram plugin <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse vulnerability
Missing Authorization to Authenticated Subscriber+ Subscription Approve/Pause/Refuse vulnerability discovered by István Márton in WordPress Plugin Contact Form 7 Telegram versions = 0.8.5...
CVE-2024-10289
Cross-Site Scripting XSS vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /mlss/ManageSubscription, parameter MSubListName...
CVE-2024-9583
CVE-2024-9583 affects the WordPress plugin “RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging” up to version 4.23.12. The issue is a missing capability check in the wprss_ajax_send_premium_support function, enabling authenticated users with Subscriber-level access and above ...
Malicious code in paddle-subscription (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9751 Malicious code in paddle-subscription (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2023-7287
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the ptcancelsubscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...
CVE-2023-7287
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the ptcancelsubscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...
CVE-2023-7287
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the ptcancelsubscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...
CVE-2023-7287 Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the ptcancelsubscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...
CVE-2023-7287
The CVE-2023-7287 entry concerns the WordPress Paytium: Mollie payment forms & donations plugin (versions up to and including 4.3.7). The root cause is a missing capability check in the pt_cancel_subscription function, allowing authenticated users with subscriber-level access to cancel subscripti...
CVE-2023-7287 Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the ptcancelsubscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...
WordPress plugin Paytium: Mollie payment forms & donations 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
PT-2024-15268 · WordPress · The Paytium: Mollie Payment Forms & Donations
Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized subscription cancellation due to a missing capability check on the pt cancel subscriptio...
USN-7063-1 ubuntu-advantage-desktop-daemon vulnerability
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon leaked the Pro token to unprivileged users by passing the token as an argument in plaintext. An attacker could use this issue to gain unauthorized access to an Ubuntu Pro subscription. CVE-2024-6388...
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and SharePoint Enterprise Server lies in their lack of access control mechanisms, which allows attackers to increase their privileges.
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and SharePoint Enterprise Server is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to increase their privileges...
PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet
A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service DoS condition. Repeated attempts to trigger this condition will result in PAN-OS entering...
