The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin’s settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
More Stories
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc38
FEDORA-2024-d652859efb Packages in this update: golang-gvisor-20240408.0-1.20240418git9e5a99b.fc38 Update description: Update golang-gvisor to 20240408.0 Read More
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc39
FEDORA-2024-9cc0e0c63e Packages in this update: golang-gvisor-20240408.0-1.20240418git9e5a99b.fc39 Update description: Update golang-gvisor to 20240408.0 Read More
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc40
FEDORA-2024-80e062d21a Packages in this update: golang-gvisor-20240408.0-1.20240418git9e5a99b.fc40 Update description: Update golang-gvisor to 20240408.0 Read More
python-reportlab-4.2.0-1.fc39
FEDORA-2024-6ec4e78241 Packages in this update: python-reportlab-4.2.0-1.fc39 Update description: Release 4.2.0 Read More
python-reportlab-4.2.0-1.fc40
FEDORA-2024-dc844d0669 Packages in this update: python-reportlab-4.2.0-1.fc40 Update description: Release 4.2.0 Read More
USN-6743-1: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This...