Total
4055 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-44019 | 1 Renzojohnson | 1 Contact Form 7 Campaign Monitor Extension | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through 0.4.67. | |||||
| CVE-2024-44020 | 1 Prasadkirpekar | 1 Wp Free Ssl | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in Prasad Kirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS allows . This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through 1.2.6. | |||||
| CVE-2024-43980 | 1 Cozythemes | 1 Fotawp | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1. | |||||
| CVE-2024-43979 | 1 Cozythemes | 1 Blockbooster | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10. | |||||
| CVE-2024-43974 | 1 Cozythemes | 1 Revivenews | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2. | |||||
| CVE-2024-43973 | 1 Ayecode | 1 Getpaid | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in AyeCode Ltd GetPaid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through 2.8.11. | |||||
| CVE-2024-43968 | 1 Newspack | 1 Newspack | 2024-11-08 | N/A | 8.8 HIGH |
| Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6. | |||||
| CVE-2024-43962 | 1 Lws | 1 Affiliation | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4. | |||||
| CVE-2024-43956 | 1 Caseproof | 1 Memberpress | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34. | |||||
| CVE-2024-43431 | 2024-11-08 | N/A | 7.5 HIGH | ||
| A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access. | |||||
| CVE-2024-10824 | 2024-11-08 | N/A | N/A | ||
| An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token (PAT) and required that secret scanning be enabled on user-owned repositories. This vulnerability affected GitHub Enterprise Server versions after 3.13.0 but prior to 3.14.0 and was fixed in version 3.13.2. | |||||
| CVE-2024-43937 | 1 Themeum | 1 Wp Crowdfunding | 2024-11-08 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10. | |||||
| CVE-2024-38190 | 1 Microsoft | 1 Power Platform | 2024-11-08 | N/A | 8.6 HIGH |
| Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. | |||||
| CVE-2024-7429 | 1 Katieseaborn | 1 Zotpress | 2024-11-08 | N/A | 4.3 MEDIUM |
| The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings. | |||||
| CVE-2024-50456 | 1 Seopress | 1 Seopress | 2024-11-07 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in The SEO Guys at SEOPress SEOPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through 8.1.1. | |||||
| CVE-2024-50455 | 1 Seopress | 1 Seopress | 2024-11-07 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in The SEO Guys at SEOPress SEOPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through 8.1.1. | |||||
| CVE-2024-49367 | 1 Nginxui | 1 Nginx Ui | 2024-11-07 | N/A | 7.5 HIGH |
| Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue. | |||||
| CVE-2024-44082 | 2024-11-07 | N/A | 4.3 MEDIUM | ||
| In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1. | |||||
| CVE-2024-50459 | 1 Hmplugin | 1 Aidwp | 2024-11-06 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in HM Plugin WordPress Stripe Donation and Payment Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Stripe Donation and Payment Plugin: from n/a through 3.2.3. | |||||
| CVE-2024-21250 | 1 Oracle | 1 Process Manufacturing Product Development | 2024-11-06 | N/A | 8.1 HIGH |
| Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specification). Supported versions that are affected are 12.2.13-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Product Development accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Product Development accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | |||||