WordPress LiteSpeed Cache 5.6 Cross Site Scripting

Vulnerability Summary from Wordfence Intelligence Description: LiteSpeed Cache = 5.6 – Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Affected Plugin: LiteSpeed Cache Plugin Slug: litespeed-cache Affected Versions: = 5.6 CVE ID: CVE-2023-4372 CVSS Score: 6.4 Medium CVSS...

CVE-2021-4372 WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting

The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import function. This makes it possible for unauthenticated attackers to...

CVE-2021-4372

The CVE-2021-4372 entry concerns the WordPress plugin “WooCommerce Dynamic Pricing and Discounts.” A Stored Cross-Site Scripting flaw exists in versions up to and including 2.4.1 due to missing sanitization on settings imported via the import() function. This allows unauthenticated attackers to s...

CVE-2022-4372 Web Invoice <= 2.1.3 - Authenticated SQLi

The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as...

CVE-2022-4372

The CVE-2022-4372 entry corresponds to the Web Invoice WordPress plugin (versions ≤ 2.1.3) with a SQL Injection vulnerability caused by improper sanitization/escaping of a parameter before its use in a SQL statement. The issue enables exploitation by high-privilege users (e.g., admin by default; ...

Security Bulletin: IBM Verify Gateway does not hide client secrets when debug tracing is active (CVE-2020-4372)

Summary When the IBM Verify Gateway IVG components are run with debug tracing, client secrets such as the username, password, and client-id are included in the debug log. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and IVG for Windows Login, these client...

CVE-2020-4372

IBM Verify Gateway IVG 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009...

CVE-2020-4372

Summary: CVE-2020-4372 affects IBM Verify Gateway (IVG) components and enables exposure of client secrets when debug tracing is enabled, resulting in plaintext credentials readable by a local attacker. Affected products/versions (per IBM): IVG RADIUS 1.0.0; IVG PAM 1.0.0, 1.0.1; IVG Windows Login...

Ubuntu: Security Advisory (USN-4372-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4372-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4372-1 advisory. It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a deni...

CVE-2018-4372

CVE-2018-4372 covers multiple memory corruption issues addressed in WebKit/Safari components. Affected products/versions include iOS prior to 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, and iCloud for Windows 7.8. Root cause: memory handling weaknesses leading to memory corruption...

Debian DSA-4372-1 : ghostscript - security update

Tavis Ormandy discovered a vulnerability in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed despite the -dSAFER sandbox being enabled. C Tenable Network Security, Inc. The...

openSUSE Security Update : webkit2gtk3 (openSUSE-2019-81)

This update for webkit2gtk3 to version 2.22.5 fixes the following issues : Security issues fixed : - CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306,...

openSUSE Security Update : webkit2gtk3 (openSUSE-2019-68)

This update for webkit2gtk3 to version 2.22.4 fixes the following issues : Security issues fixed : CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319,...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:0092-1)

This update for webkit2gtk3 to version 2.22.5 fixes the following issues : Security issues fixed : CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306,...

SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:0059-1)

This update for webkit2gtk3 to version 2.22.4 fixes the following issues : Security issues fixed : CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319,...

CVE-2018-4372

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

UBUNTU-CVE-2018-4372

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

[ASA-201811-20] webkit2gtk: arbitrary code execution

Arch Linux Security Advisory ASA-201811-20 ========================================== Severity: Critical Date : 2018-11-22 CVE-ID : CVE-2018-4372 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-819 Summary ======= The package webkit2gtk...

Apple iTunes < 12.9.1 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.9.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209197 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...