Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations.
This issue affects Estomed Sp. z o.o. Simple Care software in all versions. The software is no longer sup...
AFFECTED_PRODUCTS:
Estomed Simple Care
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.
AFFECTED_PRODUCTS:
Dreryk Gabinet
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms.
AFFECTED_PRODUCTS:
Checkmk Checkmk
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.
This issue affects Eurosoft Przychodnia software before version 20240417.001 (from that version vulnerabi...
AFFECTED_PRODUCTS:
Eurosoft Przychodnia
In the Linux kernel, the following vulnerability has been resolved:
net: fix __dst_negative_advice() race
__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_r...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+4)
Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.16.
AFFECTED_PRODUCTS:
Netgsm Netgsm
Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
AFFECTED_PRODUCTS:
Seedprod Rafflepress
Missing Authorization vulnerability in Avirtum iPages Flipbook.This issue affects iPages Flipbook: from n/a through 1.5.1.
AFFECTED_PRODUCTS:
Ipages Flipbook Project Ipages Flipbook
A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick use...
AFFECTED_PRODUCTS:
Parisneo Lollms Web Ui
Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
AFFECTED_PRODUCTS:
Codeparrots Easy Forms For Mailchimp
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
AFFECTED_PRODUCTS:
Getawesomesupport Awesome Support
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11.
AFFECTED_PRODUCTS:
Codepeople Wp Time Slots Booking Form
Missing Authorization vulnerability in Tickera.This issue affects Tickera: from n/a through 3.5.2.6.
AFFECTED_PRODUCTS:
Tickera Tickera
Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6.
AFFECTED_PRODUCTS:
Actpro Extra Product Options For Woocommerce
Missing Authorization vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.19.
AFFECTED_PRODUCTS:
Themekraft Buddypress Woocommerce My Account Integration. Create Woocommerce Member Pages
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.6.
AFFECTED_PRODUCTS:
La-Studioweb Element Kit For Elementor
Missing Authorization vulnerability in Bosa Themes Bosa Elementor Addons and Templates for WooCommerce.This issue affects Bosa Elementor Addons and Templates for WooCommerce: from n/a through 1.0.12.
AFFECTED_PRODUCTS:
Bosathemes Bosa Elementor Addons And Templates For Woocommerce
Missing Authorization vulnerability in Andrew Rapps Dashboard To-Do List.This issue affects Dashboard To-Do List: from n/a through 1.2.0.
AFFECTED_PRODUCTS:
Arwebdesign Dashboard To Do List
Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
AFFECTED_PRODUCTS:
Awplife Slider Responsive Slideshow
Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
AFFECTED_PRODUCTS:
Awplife Image Gallery
Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: from n/a through 1.5.7.
AFFECTED_PRODUCTS:
Awplife Album Gallery
Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.
AFFECTED_PRODUCTS:
Awplife Media Slider
Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30.
AFFECTED_PRODUCTS:
Ontraport Pilotpress
Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98.
AFFECTED_PRODUCTS:
Tms-Outsource Amelia
Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28.
AFFECTED_PRODUCTS:
Code4Recovery 12 Step Meeting List
Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13.
AFFECTED_PRODUCTS:
Yoginetwork Rabbitloader
The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because poly_frommsg in poly.c does not prevent Clang from em...
AFFECTED_PRODUCTS:
Pq-Crystals Kyber
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset pr...
AFFECTED_PRODUCTS:
Lunary Lunary
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misint...
AFFECTED_PRODUCTS:
PHP PHP,
PHP PHP,
PHP PHP
... (+2)
On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.
AFFECTED_PRODUCTS:
Mitel 6869i Sip Firmware
An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated u...
AFFECTED_PRODUCTS:
Mitel 6869i Sip Firmware,
Mitel 6869i Sip Firmware
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkc...
AFFECTED_PRODUCTS:
PHP PHP,
PHP PHP,
PHP PHP
... (+1)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command...
AFFECTED_PRODUCTS:
PHP PHP,
PHP PHP,
PHP PHP
... (+1)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs)...
AFFECTED_PRODUCTS:
PHP PHP,
PHP PHP,
PHP PHP
... (+4)
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
AFFECTED_PRODUCTS:
Authlib Authlib
Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4.
AFFECTED_PRODUCTS:
Opmc Woocommerce Dropshipping
Missing Authorization vulnerability in Andreas Sofantzis Simple COD Fees for WooCommerce.This issue affects Simple COD Fees for WooCommerce: from n/a through 2.0.2.
AFFECTED_PRODUCTS:
83Pixel Simple Cod Fees For Woocommerce
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
AFFECTED_PRODUCTS:
Softlabbd Upload Fields For Wpforms
Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
AFFECTED_PRODUCTS:
Wpfoxly Adfoxly
Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
AFFECTED_PRODUCTS:
Websupporter Filter Custom Fields \& Taxonomies Light Project Websupporter Filter Custom Fields \& Taxonomies Light
Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.1.3.
AFFECTED_PRODUCTS:
Multivendorx Multivendorx
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8.
AFFECTED_PRODUCTS:
Wpdeveloper Embedpress
Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.2.
AFFECTED_PRODUCTS:
Zorem Advanced Local Pickup For Woocommerce
Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.
AFFECTED_PRODUCTS:
Wpfactory Products\, Order \& Customers Export For Woocommerce
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.
AFFECTED_PRODUCTS:
Metagauss Eventprime
Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.
AFFECTED_PRODUCTS:
Autowriter Ai Post Generator \| Autowriter
Missing Authorization vulnerability in reputeinfosystems ARForms.This issue affects ARForms: from n/a through 6.4.
AFFECTED_PRODUCTS:
Reputeinfosystems Arforms
Missing Authorization vulnerability in reputeinfosystems ARForms.This issue affects ARForms: from n/a through 6.4.
AFFECTED_PRODUCTS:
Reputeinfosystems Arforms
Missing Authorization vulnerability in reputeinfosystems ARForms.This issue affects ARForms: from n/a through 6.4.
AFFECTED_PRODUCTS:
Reputeinfosystems Arforms
Missing Authorization vulnerability in InstaWP Team InstaWP Connect.This issue affects InstaWP Connect: from n/a through 0.1.0.24.
AFFECTED_PRODUCTS:
Instawp Instawp Connect