WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ElasticPress versions = 5.1.1...

CVE-2024-5449

The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdmsocialsharesaveoptions function in all versions up to, and...

CVE-2024-4295

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2024-33557

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8...

CVE-2024-2421

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions...

NetBox Security Vulnerability

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in LenelS2 NetBox 5.6.1 and earlier versions that stems from the presence of a remote code execution vulnerability...

WordPress plugin The Plus Addons for Elementor Page Builder 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the CONNECT v5 component of the Eclipse Mosquitto messaging broker allows a attacker to cause a service failure.

The vulnerability of the CONNECT v5 component of the Eclipse Mosquitto messaging broker is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Yokogawa Rental & Lease Unifier 安全漏洞

Yokogawa Rental & Lease Unifier is a solution focused on equipment rental and lease management from Yokogawa Rental & Lease Japan. A security vulnerability exists in Yokogawa Rental & Lease Unifier version 5.0 and later, which stems from a lack of authorization for coejobhook command execution...

IBM Aspera 跨站脚本漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Aspera Faspex versions 5.0.0 through 5.0.6, which stems from the application's lack of effective filtering...

WordPress Event post plugin <= 5.9.4 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Francesco Carlucci in WordPress Plugin Event post versions = 5.9.4...

CVE-2024-5142

Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser...

WordPress plugin iframe 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2024-26468 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.114 Description: The issue concerns an arbitrary file upload vulnerability located on the media add .php page in the backend of the website. Recommendations: For version 5.7.114, consider restricting access to the media ad...

VulnCheck KEV: CVE-2024-21683

This High severity RCE Remote Code Execution vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.3, allows an authenticated attacker to execute arbitrary code which has high impact to...

PT-2024-40178 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.2.25 Description: The issue allows for the execution of authorized foreign code under certain circumstances. Recommendations: For versions prior to 5.2.25, update to version 5.2.25 or later to resolve the issue...

PT-2024-11231 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.13.0-rc3+ 360 Description: The vulnerability is related to the egress tunnel code in the Linux kernel's bridge module. The code uses dst clone and directly sets the result, which can cause problems if the entr...

WordPress plugin Fluent Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-41955

Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8...

WordPress plugin Essential Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...