Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowe...

WP Google Map < 4.4.0 - Editor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Interactive Polish Map Type Plugin Vulnerable versions = 1.2 Fixed in 1.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23821 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID be3ac8b7a0a2 Credits Rio Darmawan...

PT-2023-9336 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition in the fastrpc map find function, which can lead to use-after-free. This occurs due to a race window between the point when the mutex is unlock...

WordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)

Software WP Google Map Plugin Type Plugin Vulnerable versions = 4.3.9 Fixed in 4.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23878 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a087af02892c Credits Rafshanzani Suhada...

PT-2023-9450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a use-after-free race condition in the fastrpc component of the Linux kernel. This condition can occur when one thread calls fastrpc map get and another thread...

Interactive Polish Map < 1.2.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-22731

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like "map", "filter", "sort". This allows a template to call any global PHP function and thus execute...

GSD-2023-1000947 btrfs: fix extent map use-after-free when handling missing device in read_one_chunk

btrfs: fix extent map use-after-free when handling missing device in readonechunk This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by...

GSD-2023-1000496 btrfs: fix extent map use-after-free when handling missing device in read_one_chunk

btrfs: fix extent map use-after-free when handling missing device in readonechunk This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.18 by...

WordPress plugin OSM—OpenStreetMap 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-34525

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A race condition exists in the sock map free function of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

PT-2023-34584

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A reference count leak was discovered in the snr uncore mmio map function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

PT-2023-34220

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A race condition exists in the sock map free function related to bpf and sockmap. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2023-33816

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description A race condition exists in the sock map free function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v6.0.16, update to...

PT-2023-33573

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.18 Description The issue is related to a use-after-free error in the extent map when handling a missing device in read one chunk. The actual impact and attack plausibility have not yet been proven...

PT-2023-34024

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.87 Description The issue is related to a use-after-free in the extent map when handling a missing device in read one chunk. The actual impact and attack plausibility have not yet been proven. Recommendation...

CVE-2023-22731: Improper Control of Generation of Code

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows a template to call any global PHP function and thus execute arbitra...

PT-2023-34286

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A reference count leak was discovered in the snr uncore mmio map function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Map Multi Marker Type Plugin Vulnerable versions = 3.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47591 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fa0897cb0de Credits minhtuanact Requir...