WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control

Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...

CVE-2023-31217

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in MyTechTalky User Location and IP plugin = 1.6 versions...

PT-2023-23238 · Mytechtalky · Mytechtalky User Location/Ip Plugin

Name of the Vulnerable Software and Affected Versions: MyTechTalky User Location and IP plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication...

CVE-2023-45144

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting XSS and XWiki syntax...

PT-2023-29818 · Codedrafty · Codedrafty Mediabay – Media Library Folders

Name of the Vulnerable Software and Affected Versions: Codedrafty Mediabay – Media Library Folders plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher privileges. This...

CVE-2023-45132

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132 IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132 IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-4492

Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to...

CVE-2023-4493

Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the usersadmin.ghp file that affects multiple parameters such as firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip. This vulnerability allows a...

PT-2023-29317 · Unknown · Easy Address Book Web Server

Name of the Vulnerable Software and Affected Versions: Easy Address Book Web Server version 1.6 Description: The issue affects the parameters firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, and workzip of the "/addrbook.ghp" file, allowing an...

Cross site scripting

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

HashiCorp Vault Input Validation Error Vulnerability

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. An input validation error vulnerability exists in HashiCorp Vault and Vault Enterprise versions 1.6.0 and later, which stems from a security flaw in the transit secrets engine that allows the transit secrets engi...

CVE-2023-4229

A vulnerability has been identified in ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized dat...

MOXA ioLogik 4000 Series 安全漏洞

MOXA ioLogik 4000 Series is a series of general-purpose controllers from China-based MOXA. A security vulnerability exists in MOXA ioLogik 4000 Series v1.6 and earlier versions, which stems from the ability to gain unauthorized access, potentially leading to the disclosure of sensitive informatio...

PT-2023-4557 · Moxa · Iologik 4000 Series

Name of the Vulnerable Software and Affected Versions: ioLogik 4000 Series ioLogik E4200 versions v1.6 and prior Description: A vulnerability has been identified that can be exploited by malicious actors to potentially gain unauthorized access to the product, leading to security breaches, data...

MOXA ioLogik 4000 Series 安全漏洞

MOXA ioLogik 4000 Series is a series of general-purpose controllers from China-based MOXA. A security vulnerability exists in MOXA ioLogik 4000 Series v1.6 and earlier versions, which stems from a vulnerability that could allow an attacker to gather information to evaluate vulnerabilities and...

CVE-2023-40340

Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in the Npm config file in Pipeline build logs...

STRRAT a Java-Powered Versatile Remote Access Trojan

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary STRRAT, a Java-based RAT, excels in utilizing a wide array of capabilities. Its latest version, STRRAT 1.6, is notable for employing diverse infection paths and conducting startup host queries to...