40320 matches found
PT-2025-21679 · WordPress · Wp Ultimate Tours Builder
Name of the Vulnerable Software and Affected Versions: WP Ultimate Tours Builder versions 1.055 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the loopus WP Ultimate Tours Builder, allowing unauthorized actions to be performed on behalf of a user. This is a type of attac...
Oracle Linux 8 : kernel (ELSA-2025-7531)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7531 advisory. - netfilter: ipset: add missing range check in bitmapipuadt Florian Westphal RHEL-70268 CVE-2024-53141 Tenable has extracted the preceding description...
PT-2025-21709 · Romancode · Mapsvg
Name of the Vulnerable Software and Affected Versions: MapSVG versions prior to 8.5.32 Description: The issue is related to a Missing Authorization vulnerability in RomanCode MapSVG, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior...
Oracle Linux 8 : .NET / 9.0 (ELSA-2025-7571)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7571 advisory. 9.0.106-1.0.1 - Add support for Oracle Linux 9.0.106-1 - Update to .NET SDK 9.0.106 and Runtime 9.0.5 - Resolves: RHEL-89451 9.0.105-2 - Update to .NET SDK...
Security Updates for Microsoft Office Products C2R (May 2025)
The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-30377, CVE-2025-30386 Note that...
SUSE: Security Advisory (SUSE-SU-2025:1549-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Updates for Microsoft Excel Products C2R (May 2025)
The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-29977, CVE-2025-29979,...
Important Photon OS Security Update - PHSA-2025-4.0-0800
Updates of 'syslog-ng' packages of Photon OS have been released...
CVE-2025-2247
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8245
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8082
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8050
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-6719
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...
CVE-2024-12750
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-10677
The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2023-7229
The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-4665
EventPrime WordPress plugin before 3.5.0 contains a permissions validation flaw in the booking update flow, allowing a user to modify or cancel bookings for other users. The issue is compounded by the absence of a nonce to protect the operation. Impact, as documented, is limited to unauthorized c...
CVE-2023-7297
The CVE-2023-7297 entry concerns the TwitterPosts WordPress plugin (versions up to 1.0.2). The connected documents confirm a vulnerability where there is no CSRF protection when updating plugin settings, enabling a logged-in administrator to change settings via CSRF. This is documented across mul...
CVE-2024-9233 GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
