CVE-2024-37267

CVE-2024-37267 concerns the WordPress Striking theme (

WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

Subscriber+ Multiple Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin User Activity Log Pro versions = 2.3.4...

WordPress plugin Striking path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Striking Theme <= 2.3.4 is vulnerable to Local File Inclusion

Software Striking Type Theme Vulnerable versions = 2.3.4 Fixed in 2.3.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-37268 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3bf80a88872b Credits Rafie Muhammad Patchstack Required privilege...

WordPress plugin Simple Org Chart security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Custom Font Uploader Plugin <= 2.3.4 is vulnerable to Broken Access Control

Software Custom Font Uploader Type Plugin Vulnerable versions = 2.3.4 Fixed in 2.4.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5489 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ec1d5e78e0ec Credits Lucio Sá Required privile...

Emlog Pro 授权问题漏洞

emlog is a PHP and MySQL based CMS builder for emlog personal developers. An authorization issue vulnerability exists in Emlog Pro version 2.3.4, which stems from incorrect authentication of the parameter AuthCookie of the component Cookie Handler. An attacker can exploit this vulnerability to...

CVE-2024-29470

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the component rootpath/links...

CVE-2024-29470

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the component rootpath/links...

OneBlog 安全漏洞

OneBlog is a beautiful and powerful Java blog. A security vulnerability exists in OneBlog v2.3.4, which stems from a stored cross-site scripting XSS vulnerability in the Privilege Management module...

PT-2024-22917 · Oneblog · Oneblog

Name of the Vulnerable Software and Affected Versions: OneBlog version 2.3.4 Description: A stored cross-site scripting XSS issue was found in the Notice Manage module. This allows for malicious scripts to be stored and executed on the site, potentially leading to unauthorized actions or data...

OneBlog 安全漏洞

OneBlog is a Java blog. A cross-site scripting vulnerability exists in OneBlog v2.3.4, which stems from a lack of effective filtering and escaping of user-supplied data in the User Management module, and can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a...

BIT-TENSORFLOW-2021-37670 Heap OOB in `UpperBound` and `LowerBound` in TensorFlow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.UpperBound. The implementation does not validate the rank of sortedinput...

BIT-TENSORFLOW-2021-37689 Null pointer dereference in TensorFlow Lite MLIR optimizations

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of L2NormalizeReduceAxis...

BIT-MAGENTO-2020-9591

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

Malicious code in paalni (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80fe310fa14b18a156e781ff55555ecf5c96db6a03102615f4a93d8e961db75a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress EazyDocs Plugin < 2.3.4 is vulnerable to SQL Injection

Software EazyDocs Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-6035 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 6ad682fb44ae Credits Dao Xuan Hieu Required privilege Subscriber Published 19...

DFIRKuiper Kuiper Path Traversal Vulnerability

DFIRKuiper Kuiper is a digital investigation platform from the individual developers of DFIRKuiper that provides investigative teams and individuals with the ability to parse, search, and visualize collected evidence. A path traversal vulnerability exists in DFIRKuiper Kuiper version 2.3.4, which...

PT-2023-32488 · WordPress · Eazydocs

Name of the Vulnerable Software and Affected Versions: EazyDocs WordPress plugin versions prior to 2.3.4 Description: The issue arises from the improper sanitization and escaping of the data parameter before its use in an SQL statement via an AJAX action. This could allow any authenticated users ...