CVE-2024-30517

WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Slicedinvoices

Products

Sliced Invoices

CVE-2024-30515

WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelite

Products

Events Manager

CVE-2024-30512

WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Weformspro

Products

Weforms

CVE-2024-30484

WordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from n/a through 2.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Risethemes

Products

Rt Easy Builder

CVE-2024-30470

WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Yithemes

Products

Woocommerce Account Funds

CVE-2024-30467

WordPress Essential Blocks plugin <= 4.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Essential Blocks

CVE-2024-30466

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Onthegosystems

Products

Woocommerce Multilingual \& Multicurrency

CVE-2024-30465

WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pagelayer

Products

Pagelayer

CVE-2024-2743

Incorrect Authorization in GitLab

An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2024-25929

WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Multivendorx

Products

Product Catalog Mode For Woocommerce

CVE-2024-25643

Missing authorization check in SAP Fiori app (My Overtime Requests)

The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Fiori

CVE-2024-25092

WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Xlplugins

Products

Nextmove

CVE-2024-24822

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pimcore

Products

Admin Classic Bundle

CVE-2024-24774

Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Server

CVE-2024-24751

Broken Access Control in Backend Module in sf_event_mgt

sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Derhansen

Products

Event Management And Registration

CVE-2024-24741

Missing Authorization check in SAP Master Data Governance Material

SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Master Data Governance For Material Data

CVE-2024-24716

WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Getawesomesupport

Products

Awesome Support

CVE-2024-24704

WordPress Load More Anything plugin <= 3.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in AddonMaster Load More Anything.This issue affects Load More Anything: from n/a through 3.3.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Addonmaster

Products

Load More Anything

CVE-2024-23653

BuildKit interactive containers API does not validate entitlements check

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed

Vendors

Mobyproject

Products

Buildkit

CVE-2024-23629

Motorola MR2600 Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information.

CVSS 3.1 · 9.6 Critical EPSS 1.1% KEV · Not listed

Vendors

Motorola

Products

Mr2600 Mr2600 Firmware