Threat database

A stored cross-site scripting (XSS) vulnerability exists in the xootix Waitlist Woocommerce (Back in stock notifier) plugin, affecting versions up to 2.9.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to inject malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation versions up to 2.4.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The issue is rated medium severity with a CVSS score of 6.5.

A missing authorization vulnerability exists in yoomoney ЮKassa для WooCommerce yookassa, affecting versions up to 2.17.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently available.

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1 Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

A critical security update has been released for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17. This update addresses multiple vulnerabilities identified by several CVEs, including CVE-2024-38827 and numerous others. Users of Openshift Jenkins 4.17 are recommended to upgrade to the latest version to mitigate these security issues. No detailed technical information or specific vulnerability descriptions are provided in the advisory.

A vulnerability in WP Desk ShopMagic for WooCommerce (up to version 4.9.1) allows insertion of sensitive information into files or directories accessible externally. This could lead to unauthorized retrieval of embedded sensitive data. The issue is identified as CWE-538 and has a medium severity with a CVSS score of 5.3.

A missing authorization vulnerability exists in Ahmad Majestic Support (majestic-support) up to version 1.2.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a medium severity with a CVSS score of 5.3 and does not affect confidentiality or availability. No patch or remediation information is currently provided.

A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin (page-and-post-restriction) up to version 1.6.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially permitting unauthorized access to restricted content. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation details are provided in the available data.

A missing authorization vulnerability exists in WP Sunshine Sunshine Photo Cart up to version 3.7.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently provided.

An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.