CVE-2024-36424

CVE-2024-36424 affects K7 Ultimate Security prior to version 17.0.2019, via the driver file K7RKScan.sys . The vulnerability is a NULL pointer dereference that, when triggered through IOCTLs 0x222010/0x222014, allows a local attacker to cause a denial of service (BSOD). Impact is a system crash; ...

CVE-2024-36424

K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service BSOD because of a NULL pointer dereference...

CVE-2024-6529

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6529: Improper Neutralization of Input During Web Page Generation

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Ultimate Classified Listings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Ultimate Classified Listings plugin < 1.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin Ultimate Classified Listings versions 1.3...

WordPress Ultimate Classified Listings plugin < 1.3 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by Project Black in WordPress Plugin Ultimate Classified Listings versions 1.3...

CVE-2024-6362

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-5882

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the uclpage and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page...

CVE-2024-6362

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6362

The Ultimate Blocks WordPress plugin versions prior to 3.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is a failure to properly validate and escape certain post-grid block attributes before they are outputted in a page or post where the block is embedded. This vu...

CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6362 Ultimate Blocks < 3.2.0 - Contributor+ Stored XSS

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-5882 Ultimate Classified Listings < 1.3 - Unauthenticated LFI

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the uclpage and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page...

WordPress Ultimate Auction plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation vulnerability

Missing Authorization to Unauthenticated Email Creation vulnerability discovered by Lucio Sá in WordPress Plugin Ultimate Auction versions = 4.2.7...

WordPress Ultimate Auction Plugin <= 4.2.67 is vulnerable to Broken Access Control

Software Ultimate Auction Type Plugin Vulnerable versions = 4.2.67 Fixed in 4.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6591 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 97fe9efdff7a Credits Lucio Sá Required...

PT-2024-37220 · WordPress · Ultimate Classified Listings

Name of the Vulnerable Software and Affected Versions: The Ultimate Classified Listings WordPress plugin versions prior to 1.3 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...

WordPress plugin Ultimate Classified Listings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin Ultimate Classified Listings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin Ultimate Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...