Archive
16 October 2024
Vulnerabilities first published on this day (UTC), newest first.
185 results · Feed
-
High 7.1
WordPress disconnected theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sunburntkamel disconnected allows Reflected XSS.This issue affects disconnected: from n/a through 1.3.0.
-
High 7.2CVE-2024-45844 EPSS 11%
BIG-IP monitors vulnerability
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 6.8
F5 BIG-IQ Vulnerability
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the context of the currently logged-in user. Note: Software versions…
-
Critical 9.8
Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for un…
-
Medium 6.5
WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.
-
Medium 5.9
Insecure handling SSH key in SUSE Manager when bootstrapping new clients
Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys
-
Medium 5.3
WordPress leyka plugin <=3.31.6 - Broken Access Control vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through <= 3.31.6.
-
High 7.5
WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
-
Medium 5.5
Crafted projects can overwrite special files in the .osc config directory
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
-
Medium 6.5
WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerability
Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
-
Critical 9.9
WordPress Creates 3D Flipbook, PDF Flipbook plugin <= 1.2 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in fliperrr Creates 3D Flipbook, PDF Flipbook create-flipbook-from-pdf allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through <= 1.2.
-
Medium 6.3
obs-service-download_url is vulnerable to argument injection
The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
-
Critical 10.0
WordPress Feed Comments Number plugin <= 0.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.
-
Critical 10.0
WordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through <= 3.0.5.
-
Critical 9.9
WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
-
High 7.5
WordPress MaxSlider plugin <= 1.2.3 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
-
High 7.5
WordPress WPOptin plugin <= 2.0.1 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
-
High 7.5
WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: fro…
-
High 7.5
WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-elementor-addons allows Local Code Inclusion.This issue affects Maan Addons For Elementor: from n/a t…
-
Medium 6.5
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster membe…
-
Critical 9.8
WordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
-
High 8.0
Rancher agents can be hijacked by taking over the Rancher Server URL
A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the doma…
-
Critical 9.8
WordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.
-
Critical 9.8
WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
-
Critical 9.8
WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.
-
High 7.8
tomcat packaging allows for escalation to root from tomcat user
Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
-
High 8.8
WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through <= 2.8.17.
-
High 8.8
WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
-
Critical 10.0
WordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.
-
High 8.8
WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
-
High 8.6
WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability
Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.
-
Critical 9.1
WordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4.
-
Critical 9.9
WordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through <=…
-
Critical 9.9
WordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
-
Medium 6.6
Rancher's External RoleTemplates can lead to privilege escalation
A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.
-
Medium 6.3
code-projects Pharmacy Management System manage_medicine_stock.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some unknown processing of the file /php/manage_medicine_stock.php. The manipulation of the argument name/packing/generic_nam…
-
Medium 6.3
code-projects Pharmacy Management System add_new_medicine.php sql injection
A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /php/add_new_medicine.php. The manipulation of the argument name/packing/generic_name/suppliers_name leads to…
-
Critical 9.1
WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
-
Critical 10.0
WordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.
-
High 7.2
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating…