CVE-2024-8480 : IMAGE OPTIMIZER, RESIZER AND CDN PLUGIN UP TO 7.2.7 ON WORDPRESS SIRV_SAVE_PREVENTED_SIZES AUTHORIZATION

Description

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘sirv_save_prevented_sizes’ function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to exploit the ‘sirv_upload_file_by_chunks_callback’ function, which lacks proper file type validation, allowing attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3e628f-b5e7-40fd-9d34-4a3b23e1e0e7?source=cve

https://plugins.trac.wordpress.org/browser/sirv/trunk/sirv.php?rev=3103410#L4647

https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.7/sirv.php#L6331

https://plugins.trac.wordpress.org/changeset/3115018/

For More Information

CVERecord

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-10698 : TENDA AC6 15.03.05.19 /GOFORM/SETONLINEDEVNAME FORMSETDEVICENAME DEVNAME STACK-BASED OVERFLOW

CVE-2024-10698 : TENDA AC6 15.03.05.19 /GOFORM/SETONLINEDEVNAME FORMSETDEVICENAME DEVNAME STACK-BASED OVERFLOW

Description A vulnerability was found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this issue is the function

CVE-2024-41745 : IBM CICS TX STANDARD 11.1 WEB UI CROSS SITE SCRIPTING

CVE-2024-41745 : IBM CICS TX STANDARD 11.1 WEB UI CROSS SITE SCRIPTING

Description IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript

CVE-2024-49770 : OAK UP TO 17.1.2 API CONTEXT.SEND PATH TRAVERSAL

CVE-2024-49770 : OAK UP TO 17.1.2 API CONTEXT.SEND PATH TRAVERSAL

Description `oak` is a middleware framework for Deno’s native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and