205 matches found
WordPress Tutor LMS Plugin <= 2.7.2 is vulnerable to SQL Injection
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43282 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 9478cad7bdae Credits justakazh Required privilege Administrator Published 16...
WordPress myCred Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)
Software myCred Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43353 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2faf75ac250 Credits LVT-tholv2k Required privilege Contributor...
WordPress My Sticky Bar Plugin < 2.7.2 is vulnerable to Cross Site Scripting (XSS)
Software My Sticky Bar Type Plugin Vulnerable versions 2.7.2 Fixed in 2.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4090 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dec5e0412400 Credits Krugov Artyom Required...
WordPress Tutor LMS Plugin <= 2.7.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-39645 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dcc37aabdfcd Credits Rafie Muhammad Patchstack...
PT-2024-27851 · Tutor Lms · Tutor Lms
Name of the Vulnerable Software and Affected Versions: Tutor LMS versions 2.7.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions...
WordPress Tutor LMS Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37947 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54e1794329a4 Credits justakazh Required privilege editor and Tuto...
WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to Local File Inclusion
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-37266 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 8224e271a86b Credits filime Required privilege Administrator Publishe...
CVE-2023-51519
Missing Authorization vulnerability in Soliloquy Team Slider by Soliloquy.This issue affects Slider by Soliloquy: from n/a through 2.7.2...
PT-2024-14173 · Soliloquy · Slider
Name of the Vulnerable Software and Affected Versions: Slider by Soliloquy versions 2.7.2 and earlier Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access or actions...
WordPress Login/Signup Popup ( Inline Form + Woocommerce ) plugin <= 2.7.2 - Missing Authorization to Arbitrary Options Exposure vulnerability
Missing Authorization to Arbitrary Options Exposure vulnerability discovered by 1337Wannabe in WordPress Plugin Login/Signup Popup versions = 2.7.2...
CVE-2024-35232
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...
CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...
WordPress Country State City Dropdown CF7 plugin <= 2.7.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Country State City Dropdown CF7 versions = 2.7.2...
EUVD-2024-32435
The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in version 2.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
WordPress Tainacan Interface Theme <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)
Software Tainacan Interface Type Theme Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3867 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID dcbddfa32a84 Credits Matheus Nascimento de...
BIT-TENSORFLOW-2022-35995 `CHECK` fail in `AudioSummaryV2` in TensorFlow
TensorFlow is an open source platform for machine learning. When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...
BIT-TENSORFLOW-2022-36002 `CHECK` fail in `Unbatch` in TensorFlow
TensorFlow is an open source platform for machine learning. When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow...
BIT-AIRFLOW-2023-42663 Apache Airflow: Bypass permission verification to view task instances of other dags
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated wit...
BIT-AIRFLOW-2023-42792 Apache Airflow: Improper access control to DAG resources
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...