Archive
9 December 2024
Vulnerabilities first published on this day (UTC), newest first.
34 results · Clear filters · Feed
-
High 8.1
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
-
High 7.5
Directus allows unauthenticated access to WebSocket events and operations
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of…
-
High 8.5
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed…
-
High 7.8
A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow…
-
High 7.8
Untrusted Search Path vulnerability in Autodesk Revit
A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.
-
High 7.8
Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged at…
-
High 7.6
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to …
-
High 7.1
WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.
-
High 7.1
WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through <= 5.6.
-
High 7.5
WordPress Lenxel Core plugin <= 1.2.8 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
-
High 7.1
WordPress Country Blocker plugin <= 3.2 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in karlkiesinger Country Blocker country-blocker allows Stored XSS.This issue affects Country Blocker: from n/a through <= 3.2.
-
High 7.5
WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through <= 1.4.1.
-
High 7.5
WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability
Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebook Store: from n/a through 5.775.
-
High 7.5
WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
-
High 8.6
WordPress Japanized For WooCommerce plugin <= 2.6.4 - Multiple Broken Access Control vulnerability
Missing Authorization vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.4.
-
High 8.2
WordPress Accept Stripe Payments plugin <= 2.0.79 - Broken Access Control vulnerability
Missing Authorization vulnerability in mra13 Stripe Payments stripe-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through <= 2.0.79.
-
High 7.1
WordPress LadiApp plugin <= 4.4 - Broken Access Control lead to XSS vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binh Nguyen LadiApp ladipage allows Stored XSS.This issue affects LadiApp: from n/a through <= 4.4.
-
High 8.2
WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
-
High 7.5
WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 5.2.3…
-
High 8.1
WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability
Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.
-
High 8.2
WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through <= 4.0.23.
-
High 8.8
An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network…
-
High 7.5
An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network a…
-
High 8.8
An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local a…
-
High 8.8
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file …
-
High 8.8
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. Thi…
-
High 8.0
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web app…
-
High 7.5
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user document…
-
High 7.5
A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorize…
-
High 7.5
Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.
-
High 7.2
Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.
-
High 7.2
kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,
-
High 7.5
A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to ac…
-
High 7.2
KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php.