CVE-2023-45083 HyperCloud: "admin" and "serveradmin" users can be deleted

An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently...

Advisory ROSA-SA-2023-2301

Software: gzip 1.9 OS: ROSA Virtualization 2.1 packageevrstring: gzip-1.9-13.rv3.src.rpm CVE-ID: CVE-2022-1271 BDU-ID: 2022-02113 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gzip library is related to errors in file name handling. Exploitation of the vulnerability could allow an attacker...

WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Cookie Bar Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49836 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 703ecb793ab1 Credits Muhammad Daffa Required privilege Administrator...

Advisory ROSA-SA-2023-2298

Software: gnutls 3.6.16 OS: ROSA Virtualization 2.1 packageevrstring: gnutls-3.6.16-6.0.1.rv3.src.rpm CVE-ID: CVE-2021-4209 BDU-ID: 2022-01898 CVE-Crit: MEDIUM CVE-DESC.: An implementation vulnerability in the wrapnettlehashfast function of the GnuTLS cryptographic library is related to pointer...

Advisory ROSA-SA-2023-2292

Software: git 2.39.3 OS: ROSA Virtualization 2.1 packageevrstring: git-2.39.3-1.rv3 CVE-ID: CVE-2022-39253 BDU-ID: 2023-06647 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Git for Windows distributed version control system is related to a lack of service data protection. Exploitation of the...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in phoeniixx Custom My Account for Woocommerce allows Cross-Site Scripting XSS.This issue affects Custom My Account for Woocommerce: from n/a through 2.1...

CVE-2022-41616

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1...

CVE-2022-41616

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1...

Advisory ROSA-SA-2023-2291

Software: gdb 8.2 OS: ROSA Virtualization 2.1 packageevrstring: gdb-8.2-19.rv3.src.rpm CVE-ID: CVE-2019-1010180 BDU-ID: 2019-03222 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gdb module of the GDB debugger is related to an operation exceeding buffer boundaries in memory. Exploitation of the...

Advisory ROSA-SA-2023-2290

Software: fribidi 1.0.4 OS: ROSA Virtualization 2.1 packageevrstring: fribidi-1.0.4-9.rv3.src.rpm CVE-ID: CVE-2022-25308 BDU-ID: 2022-02659 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the GNU FriBidi library is caused by a buffer overflow on the stack. Exploitation of the vulnerability could...

Advisory ROSA-SA-2023-2286

Software: dhcp 4.3.6 OS: ROSA Virtualization 2.1 packageevrstring: dhcp-4.3.6-49.0.1.rv3.src.rpm CVE-ID: CVE-2022-2929 BDU-ID: None CVE-Crit: N/A CVE-DESC.: In ISC DHCP 1.0 - 4.4.3, ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, a system with access to a DHCP server that sends DHCP packets created to...

CVE-2023-5443

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...

Infodrom Software E-Invoice Approval System Security Breach

Infodrom Software E-Invoice Approval System is an electronic invoice approval system from Infodrom Software, Turkey. A security vulnerability exists in Infodrom Software E-Invoice Approval System version 2.1 that stems from improper protection of outbound error messages and alert signals...

PT-2023-32109

Name of the Vulnerable Software and Affected Versions EDM Informatics E-invoice versions prior to 2.1 Description The issue is related to improper protection for outbound error messages and alert signals, allowing account footprinting. This can potentially reveal sensitive information about user...

Advisory ROSA-SA-2023-2280

Software: cockpit 264.2 OS: ROSA Virtualization 2.1 packageevrstring: cockpit-264.2-1.0.1.rv3c.src.rpm CVE-ID: CVE-2021-3660 BDU-ID: 2021-04029 CVE-Crit: MEDIUM CVE-DESC.: A manager vulnerability for Cockpit servers is related to errors in the display of the user interface or frames. Exploitation...

WordPress plugin Team Showcase cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Advisory ROSA-SA-2023-2243

Software: avahi 0.7 OS: ROSA Virtualization 2.1 packageevrstring: avahi-0.7-19.0.1.rv3 CVE-ID: CVE-2021-3468 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A bug was discovered in avahi in versions 0.6 through 0.8. The event used to signal the termination of a client connection in the avahi Unix socket...

CVE-2023-41650

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

WordPress Feeds for YouTube Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software Feeds for YouTube Type Plugin Vulnerable versions = 2.1 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4841 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9fd258b26a01 Credits Lana Codes Required...

PT-2023-23346 · Inosoft Gmbh · Inosoft Visiwin

Name of the Vulnerable Software and Affected Versions: Inosoft VisiWin versions 7 through 2022-2.1 Description: An issue was discovered in the "%PROGRAMFILESX86%INOSOFT GmbH" folder, which has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM...