JVN#08430039: "Shonen Jump+" App for Android fails to restrict custom URL schemes properly

"Shonen Jump+" App for Android provided by SHUEISHA INC. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a use...

Fedora: Security Advisory (FEDORA-2024-8f83d0ed92)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-36328 · Unknown · Gaxx Keywords

Name of the Vulnerable Software and Affected Versions: Gaxx Keywords versions n/a through 0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

NVIDIA Drivers: Privilege Escalation

Background NVIDIA Drivers are NVIDIA's accelerated graphics driver. Description A vulnerability has been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is no known...

Exploit for Path Traversal in Ghost

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a...

PT-2024-36184 · Unknown · Yalla Ya! Simple Payment

Name of the Vulnerable Software and Affected Versions: yalla ya! Simple Payment versions 2.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can...

PT-2024-12186 · Hasthemes · Hashthemes Viral Mag

Name of the Vulnerable Software and Affected Versions: HashThemes Viral Mag versions 1.0.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For HashThemes Viral M...

PT-2024-12457 · WordPress · Easy Social Icons

Name of the Vulnerable Software and Affected Versions: Easy Social Icons versions 3.2.4 and earlier Description: A broken access control vulnerability has been identified in the Easy Social Icons plugin for WordPress. This issue allows exploiting incorrectly configured access control security...

PT-2024-12828 · Unknown +1 · Essential Plugin Portfolio/Projects +2

Name of the Vulnerable Software and Affected Versions: WP OnlineSupport, Essential Plugin Portfolio and Projects versions 1.3.7 and earlier Description: The issue affects the Portfolio and Projects plugin for WordPress, involving broken access control due to missing authorization. This allows for...

PT-2024-12830 · Supsystic · Popup By Supsystic

Name of the Vulnerable Software and Affected Versions: Popup by Supsystic versions 1.10.19 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This exposes broken access control,...

PT-2024-36209 · WordPress · Geo My Wordpress

Name of the Vulnerable Software and Affected Versions: GEO my WordPress versions n/a through 4.5.0.4 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to unauthorized access due ...

PT-2024-17661 · WordPress · Svg Shortcode

Name of the Vulnerable Software and Affected Versions: SVG Shortcode plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50193)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50193 advisory. - In the Linux kernel, the following vulnerability has been resolved: x86/entry32: Clear CPU buffers after...

PT-2024-36113 · Woocommerce · Shiptimize For Woocommerce

Name of the Vulnerable Software and Affected Versions: Shiptimize for WooCommerce versions 3.1.86 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50089)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50089 advisory. - NIST NVD Details CVE-2024-50089 Note that Nessus has not tested for this issue but has instead relied only o...

PT-2024-12659 · WordPress · Wpschoolpress

Name of the Vulnerable Software and Affected Versions: WPSchoolPress versions 2.2.3 through 2.2.7 Description: The issue involves a broken access control vulnerability, potentially exposing sensitive data. This vulnerability allows exploiting incorrectly configured access control security levels...

PT-2024-36173 · Appsplate · Appsplate

Name of the Vulnerable Software and Affected Versions: Appsplate versions n/a through 2.1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

Debian: Security Advisory (DLA-3993-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-36143 · Woocommerce · Import Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Import Export For WooCommerce versions 1.5 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation...

PT-2024-17281 · Plextrac · Plextrac

Name of the Vulnerable Software and Affected Versions: PlexTrac versions 1.61.3 through 2.8.1 Description: The issue is related to a Path Traversal vulnerability, which allows arbitrary file writes due to improper limitation of a pathname to a restricted directory. This enables unauthorized acces...