CVE-2023-38490 Kirby XML External Entity (XXE) vulnerability in the XML data handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the Xml data handler e.g. Data::decode$string, 'xml' or the Xml::parse method in site or plugin code. The Kirby core does not use any of the...

PT-2023-26469 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 Description: The issue affects all Kirby sites with user accounts, unless Kirby's AP...

WordPress MStore API Plugin <= 3.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software MStore API Type Plugin Vulnerable versions = 3.9.6 Fixed in 3.9.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3202 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7a8ee239bd4b Credits Truoc Phan Required...

WordPress MStore API Plugin <= 3.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software MStore API Type Plugin Vulnerable versions = 3.9.6 Fixed in 3.9.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3198 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8dddc497a1b9 Credits Truoc Phan Required...

WordPress MStore API Plugin <= 3.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software MStore API Type Plugin Vulnerable versions = 3.9.6 Fixed in 3.9.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3201 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID abb15f86de6f Credits Truoc Phan Required...

CVE-2022-4948

The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to interact with the plugin in...

Draytek Vigor Routers 信任管理问题漏洞

DrayTek Vigor routers are a series of routers from DrayTek Taiwan. A security vulnerability exists in Draytek Vigor Routers firmware versions prior to 3.9.6/4.2.4, Access Points firmware versions prior to v1.4.0, Switches firmware versions prior to 2.6.7, Myvigor firmware versions prior to 2.3.2 ...

CVE-2023-29236

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

PT-2023-22214 · Cththemes · Cththemes Outdoor Theme

Name of the Vulnerable Software and Affected Versions: Cththemes Outdoor theme versions 3.9.6 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)

Software Outdoor Type Theme Vulnerable versions = 3.9.6 Fixed in 3.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29236 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID badb7b865758 Credits RE-ALTER Required privilege...

K7827: tcpdump 3.9.6 vulnerability CVE-2007-3798

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

CVE-2022-3933

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks...

Cross site scripting

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

rConfig 代码问题漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig version v3.9.6. An attacker exploits the vulnerability to execute arbitrary code via specially crafted PHP files...

PT-2022-27205 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rconfig version 3.9.6 Description: An arbitrary file upload issue allows attackers to execute arbitrary code via a crafted PHP file. Recommendations: For rconfig version 3.9.6, update to a version that fixes this issue, as the current version...

CVE-2022-36793

Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin = 3.9.6 at WordPress...

PT-2022-23629 · WordPress · Wp Shop

Name of the Vulnerable Software and Affected Versions: WP Shop plugin versions 3.9.6 and earlier Description: The issue concerns Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities. This allows for changes to plugin settings and deletion of data without proper authentication...

Python DoS Vulnerability (bpo-44022) - Windows

Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...