Fariq Fadillah Gusti Insani

Name of the Vulnerable Software and Affected Versions: Majestic Support versions n/a through 1.1.0 Description: A missing authorization issue exists in Majestic Support. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Themes4WP Bulk versions 1.0.11 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 1.0.11 and earlier, update to a version that properly constrains functionality with ACLs to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Customify versions 0.4.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to unauthorized access due to the lack of proper security measures in place. Recommendations: For Customify versions 0.4.8 and earlier, update to a version that includes the necessary security patches to fix the Missing Authorization vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FameThemes OnePress versions prior to 2.3.11 **Description** The issue is related to a lack of authorization in FameThemes OnePress, which allows the exploitation of incorrectly configured access control security levels. **Recommendations** For versions prior to 2.3.11, update to version 2.3.11 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Nirweb support versions n/a through 3.0.3 **Description** The issue is related to an Authorization Bypass Through User-Controlled Key, which affects the Nirweb support. This allows for potential unauthorized access. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 3.0.3, update to a version later than 3.0.3 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Paytium versions through 4.4.11 **Description** The issue allows retrieval of embedded sensitive data due to the generation of error messages containing sensitive information. **Recommendations** For versions through 4.4.11, update to a version that contains a fix for this issue to prevent the retrieval of sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VW Automobile Lite versions prior to 2.1 **Description** The issue is related to a missing authorization vulnerability in VW THEMES VW Automobile Lite, which allows the exploitation of incorrectly configured access control security levels. **Recommendations** For versions prior to 2.1, update to a version that includes the necessary authorization controls to prevent exploitation of access control security levels.

**Name of the Vulnerable Software and Affected Versions** ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress versions up to, and including, 2.1.7 **Description** The issue arises from a missing capability check on the `elex dp export rules()` and `elex dp import rules()` functions, allowing unauthorized access to data. This enables unauthenticated attackers to import and export product rules, as well as obtain `phpinfo()` data. **Recommendations** For versions up to, and including, 2.1.7, consider disabling the `elex dp export rules()` and `elex dp import rules()` functions until a patch is available to prevent unauthorized data access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Vimeography versions prior to 2.4.4 Vimeography version 2.4.4 Description: The issue is related to the generation of error messages that contain sensitive information, allowing the retrieval of embedded sensitive data. Recommendations: For versions prior to 2.4.4, update to version 2.4.5 or later. For version 2.4.4, update to version 2.4.5 or later.

**Name of the Vulnerable Software and Affected Versions** Survey Maker versions through 3.2.0 **Description** The issue is related to missing authorization in Survey Maker, allowing exploitation of incorrectly configured access control security levels. **Recommendations** For versions through 3.2.0, update to a version that contains a fix for this issue, as the current version allows exploiting incorrectly configured access control security levels due to missing authorization. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WPSchoolPress versions 2.2.3 through 2.2.7 **Description** The issue involves a broken access control vulnerability, potentially exposing sensitive data. This vulnerability allows exploiting incorrectly configured access control security levels. Users are urged to update to the latest version to mitigate risks. **Recommendations** Update to the latest version of the WPSchoolPress plugin to mitigate the risks associated with this issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** JobBoardWP – Job Board Listings and Submissions versions 1.2.2 and earlier **Description** The issue is related to a missing authorization vulnerability in JobBoardWP, which allows the exploitation of incorrectly configured access control security levels. **Recommendations** For versions 1.2.2 and earlier, update to a version later than 1.2.2 to resolve the issue. As a temporary workaround, consider reviewing and correcting the access control security levels configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JoomSky JS Job Manager versions 2.0.0 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For JoomSky JS Job Manager versions 2.0.0 and earlier, update to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided.

**Name of the Vulnerable Software and Affected Versions** Stamped.io Product Reviews & UGC for WooCommerce versions 2.3.2 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploitation due to incorrectly configured access control security levels. **Recommendations** For Stamped.io Product Reviews & UGC for WooCommerce versions 2.3.2 and earlier, update to a version later than 2.3.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WebCodingPlace Ultimate Classified Listings versions n/a through 1.4 **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised pages. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 1.4, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Harmonic Design HD Quiz – Save Results Light versions 0.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Harmonic Design HD Quiz – Save Results Light versions 0.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CozyThemes Hello Agency versions 1.0.0 through 1.0.5 **Description** The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. **Recommendations** For versions 1.0.0 through 1.0.5, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JS Help Desk – Best Help Desk & Support Plugin versions n/a through 2.8.6 **Description** The issue affects the JS Help Desk plugin, allowing access to functionality not properly constrained by ACLs due to a missing authorization vulnerability. **Recommendations** For JS Help Desk – Best Help Desk & Support Plugin versions n/a through 2.8.6, update to a version later than 2.8.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LWS Affiliation versions through 2.3.4 **Description** The issue is related to a Missing Authorization vulnerability in LWS Affiliation, allowing exploitation of incorrectly configured access control security levels. **Recommendations** For versions through 2.3.4, update to a version that contains a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ReviveNews versions 1.0.2 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists (ACLs). This means that certain features or data may be accessible without the necessary permissions, potentially leading to unauthorized access. **Recommendations** For ReviveNews versions 1.0.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.