WordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerability

Account Takeover vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin User Toolkit versions = 1.2.3...

CVE-2024-9890

The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log i...

CVE-2024-49340

IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

WordPress plugin MaxSlider 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

IBM Watson Studio Local 跨站请求伪造漏洞

IBM Watson Studio Local is a suite of collaborative data processing solutions from International Business Machines IBM. The product includes features such as data analysis, data visualization, data cleansing and streaming data extraction. A cross-site request forgery vulnerability exists in IBM...

PT-2024-33479 · Ibm · Ibm Watson Studio Local

Name of the Vulnerable Software and Affected Versions: IBM Watson Studio Local version 1.2.3 Description: The issue is related to a cross-site request forgery vulnerability, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

PT-2024-39868 · WordPress · The Imagepress – Image Gallery

Name of the Vulnerable Software and Affected Versions: The ImagePress – Image Gallery plugin for WordPress versions prior to 1.2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization. This is due to a missing capability...

WordPress MaxSlider plugin <= 1.2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin MaxSlider versions = 1.2.3...

CVE-2024-44050

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in CryoutCreations Verbosa allows Stored XSS.This issue affects Verbosa: from n/a through 1.2.3...

WordPress plugin Verbosa 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2024-30918 · Cryoutcreations · Verbosa

Name of the Vulnerable Software and Affected Versions: CryoutCreations Verbosa versions 1.2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

WordPress WooCommerce Multiple Free Gift plugin <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding vulnerability

Insufficient Server-Side Validation to Arbitrary Gift Adding vulnerability discovered by Danielius Vargonas in WordPress Plugin WooCommerce Multiple Free Gift versions = 1.2.3...

WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Verbosa versions = 1.2.3...

CVE-2022-3459

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add...

WordPress plugin WooCommerce Multiple Free Gift 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exis...

PT-2024-11594 · WordPress · Woocommerce Multiple Free Gift

Name of the Vulnerable Software and Affected Versions: WooCommerce Multiple Free Gift plugin for WordPress versions up to, and including, 1.2.3 Description: The issue arises from the plugin not enforcing server-side checks on the products that can be added as a gift. This allows unauthenticated...

Security update for ntpd-rs (moderate)

openSUSE Security Update: Security update for ntpd-rs Announcement ID: openSUSE-SU-2024:0300-1 Rating: moderate References: Cross-References: CVE-2024-38528 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now available. Description: This update for ntpd-...

WordPress Amelia Plugin <= 1.2.4 is vulnerable to Broken Access Control

Software Amelia Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6332 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 338114c15946 Credits Nadim Zubidat Required privilege...

CVE-2024-43325

Cross-Site Request Forgery CSRF vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3...

WordPress plugin Dark Mode for WP Dashboard 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...