195 matches found
CVE-2023-5534 AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions vi...
PT-2023-32235 · Undefined · Undefined
‼ CVE-2023-5646 ‼ The AI ChatBot for WordPress is vulnerable to Directory Traversal in version 4.9.2 via the qcld openai upload pagetraining file function. This allows subscriber-level attackers to append "?php" to any existing file on the server resulting in potential DoS when appended to critic...
PT-2023-32241 · Undefined · Undefined
‼ CVE-2023-5655 ‼ The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged...
CVE-2023-5212
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take ove...
Arbitrary file deletion
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take ove...
CVE-2023-5212
CVE-2023-5212 refers to the AI ChatBot for WordPress, where an authenticated subscriber+ can misuse the qcld_openai_delete_training_file path to perform an arbitrary file deletion on the server. Affected versions are
4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1546 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts (>=4.0.0 <=4.9.2)
@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-40014 Source advisory: OSV:GHSA-G4VP-M682-QQMP...
CVE-2023-34459 OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the verifyMultiProof, verifyMultiProofCalldata, procesprocessMultiProof, or processMultiProofCalldat functions are in use, it is possible to construct merkle trees that...
SUSE CVE-2017-12894
Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookupbytestring...
SUSE CVE-2017-12993
The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions...
SUSE CVE-2017-12996
The PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2print...
SUSE CVE-2017-13001
The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfsprintfh...
SUSE CVE-2017-13005
The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xidmapenter...
SUSE CVE-2017-13010
The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:lstrnstart...
SUSE CVE-2017-13013
The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions...
SUSE CVE-2017-13023
The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobilityoptprint...
SUSE CVE-2017-13031
The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6print...
SUSE CVE-2017-13041
The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6nodeinfoprint...