Hitachi Energy SAM600 Security Vulnerability

Hitachi Energy SAM600 is Hitachi Energy's substation automation, protection and control system. A security vulnerability exists in Hitachi Energy SAM600, which originates from a security flaw in the input validation of GOOSE. Affected products and versions: Hitachi Energy Relion 670 series versio...

Authentication flaw

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlistedcontenttype? determines Content-Type permissions by performing a partial match. If the...

WordPress wpForo Forum Plugin <= 2.2.5 is vulnerable to Content Injection

Software wpForo Forum Type Plugin Vulnerable versions = 2.2.5 Fixed in 2.2.6 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-47869 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e9607ec97842 Credits Jesse McNeil Required privilege...

CVE-2023-32508

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection.This issue affects Order Your Posts Manually: from n/a through 2.2.5...

CVE-2023-46077

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

PT-2023-29829 · Arrow Plugins · The Awesome Feed – Custom Feed

Name of the Vulnerable Software and Affected Versions: The Awesome Feed – Custom Feed plugin versions 2.2.5 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-29485 · Openmct · Openmct

Name of the Vulnerable Software and Affected Versions: openmct versions 2.2.5 through 3.1.0 Description: The issue concerns a prototype pollution that can occur via an import action. Recommendations: For openmct versions 2.2.5 through 3.1.0, update to version 3.1.0 or later to resolve the issue...

WordPress Video Gallery – YouTube Gallery Plugin <= 2.2.5 is vulnerable to SQL Injection

Software Video Gallery – YouTube Gallery Type Plugin Vulnerable versions = 2.2.5 Fixed in 2.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-45069 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 3d253c27c06d Credits Ravi Dharmawan Required privilege...

CVE-2023-44264

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

CVE-2023-44264 WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

PT-2023-29177 · WordPress · The Awesome Feed – Custom Feed

Name of the Vulnerable Software and Affected Versions: The Awesome Feed – Custom Feed plugin versions 2.2.5 and earlier Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authenticated contributors to inject malicious scripts. Recommendations: For versions 2.2.5 and...

CVE-2023-29166

A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges...

CVE-2023-29166

A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges...

CVE-2023-29166

The CVE-2023-29166 issue affects Apple Pro Video Formats; the vulnerability is a logic issue in state management that may allow a user to elevate privileges. Affected versions prior to 2.2.5 are vulnerable; Apple fixed it in Pro Video Formats 2.2.5. Practical impact is elevated privileges with hi...

CVE-2023-29166

A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges...

Apple macOS Security Breach

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Pro Video Formats version 2.2.5, which originates from a user who may be able to elevate privileges...

CVE-2023-32510

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rolf van Gelder Order Your Posts Manually plugin = 2.2.5 versions...

WordPress plugin Order Your Posts Manually 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Post Timeline Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Post Timeline Type Plugin Vulnerable versions = 2.2.5 Fixed in 2.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4284 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 86a5f3c466ca Credits tnt24 Required...

PT-2023-24201 · Nextcloud +1 · Nextcloud Mail +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 1.15.3 Nextcloud Mail versions prior to 2.2.5 Nextcloud Mail versions prior to 3.02 Description: A blind SSRF attack in Nextcloud Mail allowed sending GET requests to services running in the same web server...