CVE-2023-5714

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sddbspecs function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2023-5714

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sddbspecs function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2023-5711

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2023-5710

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdconstants function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-5710 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdconstants function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-5713

CVE-2023-5713 concerns the WordPress System Dashboard plugin (versions ≤ 2.8.7). The vulnerability stems from a missing capability check in the sd_option_value() AJAX handler, allowing authenticated users with subscriber-level access and above to obtain potentially sensitive option values and des...

CVE-2023-5711 System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

WordPress System Dashboard Plugin <= 2.8.7 is vulnerable to Broken Access Control

Software System Dashboard Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5714 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8dbbe0b8bc02 Credits Dmitrii Ignatyev Required...

WordPress Smart Forms Plugin <= 2.6.84 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions = 2.6.84 Fixed in 2.6.85 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49856 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 636ea1edcfea Credits Abdi Pranata Required privile...

Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization

Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX actions in versions up to, and including, 5.36.0. This makes it possible for authenticated attackers with subscriber level...

WordPress Shortcoder Plugin <= 6.3 is vulnerable to Broken Access Control

Software Shortcoder Type Plugin Vulnerable versions = 6.3 Fixed in 6.3.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49849 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID f8adf2be0194 Credits Abdi Pranata Required privileg...

PT-2023-32283 · WordPress · System Dashboard

Name of the Vulnerable Software and Affected Versions: System Dashboard plugin for WordPress versions up to, and including, 2.8.7 Description: The issue allows unauthorized access to data due to a missing capability check on the sd constants function hooked via an AJAX action. This makes it...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated. A security vulnerability exists in Qualcomm Chipsets, which is caused by a memory corruption in the wireless interface layer when sending an SMS or writing an SMS to a SIM...

WPGetAPI 2.1.0 - 2.2.1 - Authenticated (Subscriber+) Arbitrary Options Update

Description The WPGetAPI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importendpoints function in versions 2.1.0 - 2.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update...

WordPress Awesome Support Plugin <= 6.1.10 is vulnerable to Broken Access Control

Software Awesome Support Type Plugin Vulnerable versions = 6.1.10 Fixed in 6.1.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-49757 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 3019bd4f8cbf Credits Abdi Pranata Required...

PT-2023-18297 · Qualcomm · Qualcomm Chipsets

Name of the Vulnerable Software and Affected Versions: Qualcomm Chipsets affected versions not specified Description: The issue is related to memory corruption in the Radio Interface Layer, which occurs when sending an SMS or writing an SMS to the SIM. This can potentially lead to code execution...

WordPress Elementor Timeline Widget Plugin <= 2.2 is vulnerable to Broken Access Control

Software Elementor Timeline Widget Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49755 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6352a8b50113 Credits Abdi Pranata Required...

Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion

Description The plugin is vulnerable to unauthorized access & modification of data due to a missing capability check on the caARConnect function, allowing authenticated attackers, with subscriber-level access and above, to retrieve data from the plugin and save/delete entries...

CVE-2023-37890

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge...

CVE-2023-37890

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge...