11782 matches found
PT-2024-15744 · WordPress · Wp Private Content Plus
Name of the Vulnerable Software and Affected Versions: WP Private Content Plus plugin for WordPress versions up to, and including, 3.6 Description: The issue is related to information disclosure due to the plugin not properly restricting access to posts via the REST API when a page has been made...
PT-2024-18072 · WordPress · Avada
Name of the Vulnerable Software and Affected Versions: Avada | Website Builder For WordPress & WooCommerce theme for WordPress versions up to, and including, 7.11.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the ajax import options function...
PT-2024-19920 · Unknown · M&S Consulting Email Before Download
Name of the Vulnerable Software and Affected Versions: M&S Consulting Email Before Download versions n/a through 6.9.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a w...
CVE-2024-1909 Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categori...
PT-2024-18420 · Byzoro · Byzoro Smart S42 Management Platform
Name of the Vulnerable Software and Affected Versions: Byzoro Smart S42 Management Platform versions up to 20240219 Description: A critical vulnerability has been found in the Byzoro Smart S42 Management Platform, affecting an unknown functionality of the file /useratte/userattestation.php. The...
PT-2024-18000 · WordPress · Yuki Theme
Name of the Vulnerable Software and Affected Versions: Yuki theme for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with subscriber-level access and above to reset the theme's settings due to a missing capability check on the reset customize...
DEBIAN-CVE-2021-46906
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hidsubmitctrl In hidsubmitctrl, the way of calculating the report length doesn't take into account that report-size can be zero. When running the syzkaller reproducer, a report of size 0 causes...
UBUNTU-CVE-2024-26606
In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In epoll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without a read buffer...
CVE-2024-24714
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4...
PT-2024-21205 · Skymoonlabs · Skymoonlabs Moveto
Name of the Vulnerable Software and Affected Versions: Skymoonlabs MoveTo versions n/a through 6.2 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Skymoonlabs MoveTo. This allows for the upload of files with potentially dangerous types withou...
PT-2024-21218 · WordPress · Woocommerce Checkout Field Editor
Name of the Vulnerable Software and Affected Versions: WooCommerce Easy Checkout Field Editor, Fees & Discounts versions n/a through 3.5.12 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the specified versions of WooCommerce Easy Checkout...
AZL-35148 CVE-2024-27319 affecting package pytorch for versions less than 2.2.2-1
Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...
CVE-2024-25928
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1.0.5...
GHSA-R53H-JV2G-VPX6 vulnerabilities
Vulnerabilities for packages: k9s, kubevela, zot, kots, kubescape, flux-source-controller, eksctl, helm-push, chartmuseum, trivy, k8sgpt, up, zarf, flux-helm-controller, cilium-cli, helm-operator...
CVE-2024-26583
A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete; any code past that point risks touching already freed data. This could lead to a use-after-free issue an...
CVE-2024-24802
Cross-Site Request Forgery CSRF vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9...
CVE-2024-24876
Cross-Site Request Forgery CSRF vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12...
PT-2024-17953 · WordPress · Imagerecycle
Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.13 Description: The issue is due to missing or incorrect nonce validation on the disableOptimization function, making it possible for unauthenticated...
PT-2024-18140 · WordPress · Profilepress
Name of the Vulnerable Software and Affected Versions: ProfilePress plugin for WordPress versions up to, and including, 4.14.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's login-password shortcode due to insufficient input sanitization and output escaping on...