WordPress Plugin WPPerformanceTester Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

UBUNTU-CVE-2023-46750

URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+...

Atlassian Confluence < Companion-2.0.0 / < Companion-2.0.1 (CONFSERVER-93518)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-93518 advisory. - RCE Vulnerability in Atlassian Companion App for MacOS CVE-2023-22524 Note that Nessus has not tested for this issue but has instead relied only o...

PT-2023-30183 · Apache +3 · Apache Shiro +3

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.13.0 Apache Shiro versions 2.0.0-alpha-1 through 2.0.0-alpha-3 Description: The issue is related to a URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apach...

CloudPanel Security Vulnerabilities

CloudPanel is a free software from CloudPanel open source. It is used to configure and manage servers. A security vulnerability exists in MGT CloudPanel versions 2.0.0 through 2.3.2, which stems from a vulnerability that allows a low-privileged user to achieve operating system command injection b...

Code injection

TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code...

CVE-2023-48859

TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code...

PT-2023-30987 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002RU version 2.0.0-B20190902.1958 Description: The issue is related to a post-authentication remote code execution RCE due to incorrect access control. This allows attackers to bypass front-end security restrictions and execute...

CVE-2023-45085

An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads tha...

CVE-2023-45085 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"

An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads tha...

PT-2023-31150 · Microsoft · Msgraph-Sdk-Php

Name of the Vulnerable Software and Affected Versions: msgraph-sdk-php versions prior to 1.109.1 msgraph-sdk-php versions prior to 2.0.0-RC5 Description: The Microsoft Graph PHP SDK contains a vulnerability that exposes system information through the phpinfo function. This issue affects the...

PT-2023-10832 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: ระบบบัญชีออนไลน์ Online Accounting System versions up to 1.4.0 Description: A problematic issue affects the processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input...

GHSA-75W2-QV55-X7FV openssl npm package vulnerable to command execution

The openssl aka node-openssl NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field used for command execution. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2023-49210

The openssl aka node-openssl NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field used for command execution. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2023-49210

The openssl aka node-openssl NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field used for command execution. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2023-48700

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

Code injection

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

CVE-2023-48700 Clear Text Credentials Exposed via Onboarding Task

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

CVE-2023-46734

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use issafe=html but don't actually ensure their input is safe. As of...

PT-2023-32455 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0.0 Description: The issue is related to improper access control. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where th...