|
61
|
4.3 |
MEDIUM
Network
|
wedevs
|
happy_addons_for_elementor
|
The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.2 via the Content Switcher widget. This makes it possibl…
Update
|
NVD-CWE-noinfo
|
CVE-2024-8801
|
2024-09-30 23:23 |
2024-09-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
62
|
5.4 |
MEDIUM
Network
|
gcsdesign
|
wp_category_dropdown
|
The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 1.8 due to insufficient input sanitization a…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2024-8103
|
2024-09-30 23:20 |
2024-09-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
63
|
7.5 |
HIGH
Network
boldgrid
|
w3_total_cache
|
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visibl…
Update
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2023-5359
|
2024-09-30 23:19 |
2024-09-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
|
64
|
5.3 |
MEDIUM
Network
peepso
|
peepso
|
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due…
Update
|
CWE-209
Information Exposure Through an Error Message
|
CVE-2024-7426
|
2024-09-30 23:17 |
2024-09-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
|
65
|
6.5 |
MEDIUM
Network
|
kimhuebel
|
blogintroduction-wordpress-plugin
|
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them vi…
Update
|
CWE-352
Origin Validation Error
|
CVE-2024-7862
|
2024-09-30 23:15 |
2024-09-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
66
|
8.3 |
HIGH
Network
|
proges
|
sensor_net_connect_firmware_v2
|
A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a…
Update
|
CWE-352
Origin Validation Error
|
CVE-2024-3083
|
2024-09-30 23:15 |
2024-07-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
67
|
6.1 |
MEDIUM
Network
|
proges
|
sensor_net_connect_firmware_v2
|
A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code.
Update
|
CWE-79
Cross-site Scripting
|
CVE-2024-31199
|
2024-09-30 23:15 |
2024-07-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
68
|
6.5 |
MEDIUM
Network
|
ibm
|
storage_defender
|
IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an…
Update
|
CWE-295
Improper Certificate Validation
|
CVE-2024-38324
|
2024-09-30 23:10 |
2024-09-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
69
|
5.3 |
MEDIUM
Network
|
tinfoilsecurity
|
devise-two-factor
|
Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret…
Update
|
CWE-331
Insufficient Entropy
|
CVE-2024-8796
|
2024-09-30 23:10 |
2024-09-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
70
|
6.5 |
MEDIUM
Network
|
rubayathasan
|
infolinks_ad_wrap
|
The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Update
|
CWE-352
Origin Validation Error
|
CVE-2024-8044
|
2024-09-30 23:03 |
2024-09-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
