PT-2024-38214 · WordPress · Yayextra – Woocommerce Extra Product Options

Name of the Vulnerable Software and Affected Versions: YayExtra – WooCommerce Extra Product Options plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to arbitrary file uploads due to missing file type validation in the handle upload file function. This...

WordPress Sign-up Sheets plugin <= 2.2.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Sign-up Sheets versions = 2.2.12...

CVE-2024-5331

The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to export form submissions...

WordPress plugin WANotifier 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-37825 · WordPress · Formidable Forms

Name of the Vulnerable Software and Affected Versions: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress versions up to, and including, 6.11.1 Description: The issue is related to Stored Cross-Site Scripting via the html...

CVE-2024-42160

In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fsbuildfaultattr - It missed to check validation of fault attrs in parseoptions, let's fix to add check condition in f2fsbuildfaultattr. - Use f2fsbuildfaultattr in sbistore to clean up...

WordPress Business Card plugin <= 1.0.0 - Admin+ File Upload vulnerability

Admin+ File Upload vulnerability discovered by Anjo Rev Tingson in WordPress Plugin Business Card versions = 1.0.0...

kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfcworkerwakeup lpfcworkerwakeup calls the lpfcworkdone routine, which takes the hbalock. Thus, lpfcworkerwakeup should not be called while holding the hbalock to avoid potential deadlo...

PT-2024-37729 · WordPress · Intelligence Plugin

Name of the Vulnerable Software and Affected Versions: Intelligence plugin for WordPress versions up to, and including, 1.4.0 Description: The issue allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. This is due to the plugin not...

PT-2024-37763 · WordPress · Master Currency Wp

Name of the Vulnerable Software and Affected Versions: Master Currency WP plugin versions up to, and including, 1.1.61 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the currencyconverterform shortcode. This allows authenticat...

kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfcworkerwakeup lpfcworkerwakeup calls the lpfcworkdone routine, which takes the hbalock. Thus, lpfcworkerwakeup should not be called while holding the hbalock to avoid potential deadlo...

WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Contest Gallery versions = 23.1.2...

CVE-2024-3297 Session establishment lock-up during replay of CASE Sigma1 messages

An issue in the Certificate Authenticated Session Establishment CASE protocol for establishing secure sessions between two devices, as implemented in the Matter protocol versions before Matter 1.1 allows an attacker to replay manipulated CASE Sigma1 messages to make the device unresponsive...

WordPress Social Auto Poster plugin <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

Security Bulletin: IBM InfoSphere Information Server is affected by an information disclosure vulnerability (CVE-2024-37533)

Summary An information disclosure vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2024-37533 DESCRIPTION: IBM InfoSphere Information Server could disclose sensitive user information to another user with physical access to the machine. CVSS Base score:...

CVE-2024-38755

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10...

CVE-2024-37229

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AuburnForest Blogmentor – Blog Layouts for Elementor allows Stored XSS.This issue affects Blogmentor – Blog Layouts for Elementor: from n/a through 1.5...

CVE-2024-37206

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1...

CVE-2024-37120

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Biplob Adhikari Tabs allows Stored XSS.This issue affects Tabs: from n/a through 4.0.6...

CVE-2024-37246

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jethin Gallery Slideshow allows Stored XSS.This issue affects Gallery Slideshow: from n/a through 1.4.1...