Threats affecting pkg:bitnami/powershell

A path traversal vulnerability exists in the MasterStudy LMS plugin for WordPress versions before 3.7.50. Authenticated users with Subscriber-level privileges can exploit this flaw by supplying directory traversal sequences in a specific AJAX parameter, allowing them to import arbitrary WXR XML files. This enables attackers to publish posts with attacker-controlled content under their identity without proper capability checks or nonce verification.

A missing authorization vulnerability exists in Cozmoslabs Profile Builder up to version 4.0.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability does not impact confidentiality or availability but can affect data integrity.

The MasterStudy LMS plugin for WordPress versions before 3.7.50 has a missing authorization vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without proper capability or nonce validation. Exploitation can lead to an uncaught PHP fatal error that may disclose the absolute filesystem path of the plugin if PHP error display is enabled.

A Missing Authorization vulnerability (CWE-862) exists in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons up to version 3.4.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with low confidentiality impact and no integrity or availability impact.

A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or official fix information is currently provided.

A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw could enable unauthorized access to certain functions or data within the affected software.

A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin up to version 1.6.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.

A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily on integrity without affecting confidentiality or availability.

A Missing Authorization vulnerability exists in StylemixThemes MasterStudy LMS up to version 3.7.55. This flaw involves incorrectly configured access control security levels, potentially allowing unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

A missing authorization vulnerability exists in Kit Kit (formerly ConvertKit) up to version 3.4.7. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain resources or functions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

A DOM-Based Cross-site Scripting (XSS) vulnerability exists in David Lingren's Media Library Assistant up to version 3.42. This vulnerability involves improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application.

An authorization bypass vulnerability exists in EventPrime EventPrime eventprime-event-calendar-management, allowing privilege abuse via a user-controlled key. This affects versions up to 4.3.6.0. The vulnerability has a medium severity with a CVSS score of 5.4.

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.

A Cross-Site Request Forgery (CSRF) vulnerability exists in WPFunnels up to version 3.13.5. This vulnerability allows an attacker to induce a user to perform unwanted actions on a web application in which they are authenticated. The CVSS score is 4.3, indicating a medium severity level with low complexity and no privileges required for exploitation.

A missing authorization vulnerability in the weDevs WP ERP plugin (up to version 1.17.10) allows exploitation of incorrectly configured access control security levels. This flaw could permit users with limited privileges to access certain functionality or data without proper authorization. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or patches are currently documented.

A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Flash & HTML5 Video html5-video-player up to version 2.14.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in the Gutenberg Blocks by Kadence Blocks plugin for WordPress, affecting versions up to 3.8.0.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A missing authorization vulnerability exists in the ThemeGrill User Registration plugin up to version 5.3.0. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability does not impact confidentiality or availability but can affect the integrity of the system.

A missing authorization vulnerability exists in WP User Manager up to version 2.9.26. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact with low complexity and no required privileges or user interaction.