CVE-2024-6332: The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing…

PriorityP336medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

0.36%

27.4th percentile

The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
amelia	booking_for_appointments_and_events_calendar_amelia_pro	<= 7.7	—
ameliabooking	booking_for_appointments_and_events_calendar_amelia	<= 1.2.4	—
tmsproducts	amelia	<= 1.2.3	—
tmsproducts	amelia	<= 7.7	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET EXPLOIT CVE-2014-6332 Sep 01 2016 (HFS Actor) M2

suricata·2016-09-01·CVSS 8.8

CVE-2014-6332 [HIGH] ET EXPLOIT CVE-2014-6332 Sep 01 2016 (HFS Actor) M2 ET EXPLOIT CVE-2014-6332 Sep 01 2016 (HFS Actor) M2 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2014-6332 Sep 01 2016 (HFS Actor) M2"; flow:established,to_client; http.server; content:"HFS|20|"; file.data; content:"|6f 62 6a 57 73 68 2e 72 75 6e 20 22 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c 70 75 74 74 79 2e 65 78 65 22|"; nocase; reference:cve,2014-6332; classtype:trojan-activity; sid:2023146; rev:5; metadata:affected_product Internet_Explorer, attack_target Client_Endpoint, created_at 2016_09_01, cve CVE_2014_6332, deployment Perimeter, malware_family IEiExploit, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)

Suricata

ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2

suricata·2016-05-06·CVSS 8.8

CVE-2014-6332 [HIGH] ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2 ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2"; flow:established,to_client; file.data; content:"redim"; nocase; fast_pattern; content:"Preserve"; nocase; content:"VBScript"; nocase; content:"chrw"; content:"32767"; distance:0; content:"chrw"; content:"2176"; distance:0; classtype:attempted-admin; sid:2022797; rev:4; metadata:created_at 2016_05_06, cve CVE_2014_6332, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_14, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_i

Suricata

ET EXPLOIT Possible CVE-2014-6332 DECS2

suricata·2015-02-18·CVSS 8.8

CVE-2014-6332 [HIGH] ET EXPLOIT Possible CVE-2014-6332 DECS2 ET EXPLOIT Possible CVE-2014-6332 DECS2 Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2014-6332 DECS2"; flow:established,to_client; file.data; content:"102,117,110,99,116,105,111,110,32,114,117,110,109,117,109,97,97"; classtype:trojan-activity; sid:2020460; rev:5; metadata:created_at 2015_02_18, cve CVE_2014_6332, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_14;)

Suricata

ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Function Name

suricata·2014-11-18·CVSS 8.8

CVE-2014-6332 [HIGH] ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Function Name ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Function Name Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Function Name"; flow:established,to_client; file.data; content:"function"; pcre:"/^(?:\x25(?:25)*?20|\s)*?runmumaa\W/Rs"; content:"runmumaa"; fast_pattern; reference:cve,2014-6332; classtype:attempted-user; sid:2019733; rev:7; metadata:created_at 2014_11_18, cve CVE_2014_6332, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, m