In GiveWP WordPress plugin versions before 3.19.0 a high severity vulnerability CVE-2024-11921 was detected. This vulnerability allows attackers to execute Reflected Cross-Site Scripting (XSS) attacks by exploiting an unsanitized parameter, potentially targeting high-privilege users such as administrators. To address this issue, users should upgrade to version 3.19.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11921.
Read more CMS
In the Calculated Fields Form plugin for WordPress versions 5.2.63 and prior a medium severity vulnerability CVE-2024-12601 was detected. This vulnerability allows attackers to overload server resources by sending multiple requests with excessively large CAPTCHA image dimensions, leading to potential denial of service. To fix this issue, users should upgrade Calculated Fields Form plugin for WordPress to version 5.2.64 or later. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-12601.
Read more CMS
In Liferay Portal versions starting from 7.0.0 through 7.4.3.87 and Liferay DXP versions starting from 7.4 GA through update 87, 7.3 GA through update 29 a medium severity vulnerability CVE-2024-37940 was detected. This vulnerability allows attackers to inject arbitrary web scripts or HTML into the Service Class text field in Liferay Portal and Liferay DXP, potentially leading to cross-site scripting attacks. To fix this issue, users should upgrade Liferay Portal to version 7.4.3.88 and Liferay DXP to versions 2023.Q3.1, 7.4 update 88, 7.3 update 30. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-37940.
Read more CMS
In Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 a medium severity vulnerability CVE-2024-54083 was detected. This vulnerability allows attackers to cause a client-side denial of service (DoS) to users of particular channels by sending specially crafted posts. To address this issue, users should upgrade Mattermost to version 10.1.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-54083.
Read more Communication
In Vaultwarden versions 1.32.6 and prior a high severity vulnerability CVE-2024-56335 was detected. This vulnerability allows attackers with specific conditions to update or delete groups from an organization, potentially causing denial of service or privilege escalation. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-56335.
Read more Security
In Download Manager plugin for WordPress versions 3.3.03 and prior a medium severity vulnerability CVE-2024-11768 was detected. This vulnerability allows attackers to download password-protected files due to improper password validation. To address this issue, users should upgrade to version 3.3.04 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11768.
Read more CMS
In WooCommerce Point of Sale plugin for WordPress versions up to 6.1.0 a critical severity vulnerability CVE-2024-11281 was detected. This vulnerability allows attackers to change the email and reset the password of any user, including administrators, due to insufficient validation of the ‘logged_in_user_id’ value. To address this issue, users should upgrade to version 6.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11281.
Read more E-commerce
In GitLab versions before 17.6.0 a low severity vulnerability CVE-2023-5117 was detected. This vulnerability allows attackers to access files uploaded to comments on confidential issues and epics of public projects without authentication via a direct link to the uploaded file URL. To address this issue, users should upgrade to version 17.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-5117.
Read more Developer Tools
In WPForms WordPress plugin versions prior to 1.9.2.3 a medium severity vulnerability CVE-2024-11223 was detected. This vulnerability allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disabled (e.g., in multisite setups). To address this issue, users should upgrade to version 1.9.2.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11223.
Read more CMS