CVE-2024-1851
published 2024-03-08CVE-2024-1851: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.29%
20.8th percentile
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cservit | affiliate-toolkit_multi-network_affiliate_amazon_product_display | <= 3.5.4 | — |
| servit | affiliate-toolkit | < 3.5.5 | 3.5.5 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m9rc-7xvh-66c4: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the
ghsa_unreviewed·2024-03-08
CVE-2024-1851 [MEDIUM] CWE-862 GHSA-m9rc-7xvh-66c4: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.
Red Hat
kernel: drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()
vendor_redhat·2024-11-09·CVSS 5.5
CVE-2024-50213 [MEDIUM] CWE-401 kernel: drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()
kernel: drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()
In the Linux kernel, the following vulnerability has been resolved:
drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()
modprobe drm_hdmi_state_helper_test and then rmmod it, the following
memory leak occurs.
The `mode` allocated in drm_mode_duplicate() called by
drm_display_mode_from_cea_vic() is not freed, which cause the memory leak:
unreferenced object 0xffffff80ccd18100 (size 128):
comm "kunit_try_catch", pid 1851, jiffies 4295059695
hex dump (first 32 bytes):
57 62 00 00 80 02 90 02 f0 02 20 03 00 00 e0 01 Wb........ .....
ea 01 ec 01 0d 02 00 00 0a 00 00 00 00 00 00 00 ................
backtrace (crc c2f1aa95):
[] kmemleak_alloc+0x34/0x40
[] __kmalloc_cache_noprof+0x26c/0x2f4
[] drm_mode_d
Suricata
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
suricata·2025-10-10·CVSS 8.8
CVE-2025-8810 [HIGH] ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:22; content:"/goform/SetFirewallCfg"; fast_pattern; http.request_body; content:"firewallEn|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-8810; reference:url,www.cve.org/CVERecord/SearchResults?query=SetFirewallCfg; reference:cve,2025-1851; reference:cve,2025-29358; reference:url,github.com/peris-navince/founded-0-days/blob/main/Tenda/ac8/formSetFirewallCfg/1.md; refe
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/e9e256b0-e4e3-4f41-842c-80aa2b80af72?source=cvehttps://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/e9e256b0-e4e3-4f41-842c-80aa2b80af72?source=cve
2024-03-08
Published