CVE-2024-3504 Improper Access Control in lunary-ai/lunary

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in versi...

PT-2024-36418 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.7 Description: A Cross-site Scripting XSS issue exists due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the generated response. The...

CVE-2024-31384

Cross-Site Request Forgery CSRF vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7...

PT-2024-24031

Name of the Vulnerable Software and Affected Versions Rara Theme Spa and Salon versions 1.2.7 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

WordPress Spa and Salon theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Spa and Salon versions = 1.2.7...

PT-2024-23368 · Themify · Themify Event Post

Name of the Vulnerable Software and Affected Versions: Themify Event Post versions 1.2.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

WordPress Themify Event Post Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Themify Event Post Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30440 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9d185b777884 Credits Dhabaleshwar Das Required privilege...

CVE-2024-25591

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7...

PT-2024-21021 · WordPress · Benjamin Rojas Wp Editor

Name of the Vulnerable Software and Affected Versions: Benjamin Rojas WP Editor versions 1.2.7 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not ha...

WordPress Plugin Backuply Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-2130

The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

WordPress Plugin CWW Companion Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Out-of-bounds

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive,...

CVE-2024-27294 dp-golang Go installation could be owned by wrong user

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive,...

Puppet Security Vulnerabilities

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the United States, which can be used to manage configuration files, users, cron tasks, packages, system services, and so on. A security vulnerability exists in Puppet versions prior to...

CVE-2022-42884

Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7...

PT-2024-11655 · Unknown · Wip Custom Login

Name of the Vulnerable Software and Affected Versions: WIP Custom Login versions 1.2.7 and earlier Description: A Missing Authorization issue has been identified. This issue affects the login functionality, potentially allowing unauthorized access. Recommendations: For versions 1.2.7 and earlier,...

CVE-2021-24151 WP Editor < 1.2.7 - Authenticated SQL injection

The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated admin+ blind SQL injection issue via an arbitrary parameter when making a request to save the settings...

WordPress plugin WP Editor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-52178

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7...