CVE-2023-49800

CVE-2023-49800 affects the nuxt-api-party module. The issue arises from passing unfiltered fetchOptions from the request body into ofetch, allowing an attacker to craft a URL and set excessively high retry values, triggering recursive error handling that leads to a stack overflow and DoS. A fix i...

CVE-2023-48708

CodeIgniter Shield (for CodeIgniter 4) contains a vulnerability where successful login attempts can store raw tokens in the log table. If logs are viewed, an attacker could obtain a token and misuse user authority. The issue is fixed in Shield v1.0.0-beta.8; upgrade is advised. If upgrading isn’t...

CVE-2023-48237

CVE-2023-48237 (Vim) affects Vim’s shift operation in operator-pending mode when a very large value is used, potentially overflowing an integer. The issue is fixed in Vim commit 6bf131888 and has been included in version 9.0.2112. The described impact is low and user interaction is required; a cr...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.6 is vulnerable to Broken Access Control

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47693 Patch priority High CVSS severity High 7.5 Developer Themefic PSID bddec613524f Credits minhtuanact...

CVE-2023-46243 Code execution via the edit action in XWiki platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form...

1Password reports security incident after breach at Okta

Password manager 1Password says it’s been affected by a breach at Okta, but it reports no user data has been stolen. In a security incident report, 1Password says that a member of its IT team received an unexpected email suggesting they had initiated an Okta report of a list of admins. They hadnt...

pjsor.com Cross Site Scripting vulnerability OBB-3731358

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-29031 · Netis · Netis N3Mv2

Name of the Vulnerable Software and Affected Versions: Netis N3Mv2 version 1.0.1.865 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via a crafted payload, specifically through the Hostname parameter within the WAN settings...

WordPress Contractor Contact Form Website to Workflow Tool Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Contractor Contact Form Website to Workflow Tool Type Plugin Vulnerable versions = 4.0.0 Fixed in 4.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-44245 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b979fca96216 Credits...

CVE-2023-43663

PrestaShop vulnerability CVE-2023-43663 affects PrestaShop core where, in affected versions, any module can be disabled or uninstalled from the back office—even by users with low privileges. The issue enables low-privilege users to disable portions of shop functionality, indicating an improper pr...

CVE-2023-41335

CVE-2023-41335 affects the Synapse Matrix homeserver. When users update passwords, the new credentials may be briefly held in the server’s database, potentially ending up in backups longer than expected. The issue does not grant new capabilities but violates expectations around password storage. ...

Involved in a data breach? Here’s what you need to know

If you've received a message from a company saying your data has been caught up in a breach, you might be unsure what to do next. We've put together some tips which should help you when the more or less inevitable happens. 1. Check the companys advice Every breach is different, so check the...

PT-2023-8455 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg versions prior to 6.1 Description: The issue is related to an integer overflow vulnerability in the jpegxl anim read packet function of the JPEG XL Animation decoder in the FFmpeg multimedia library. This vulnerability can be exploited...

CVE-2023-3703

Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials...

CVE-2023-3703

CVE-2023-3703 affects Proscend Advice ICR Series routers, specifically firmware version 1.76. The vulnerability arises from the use of default credentials, enabling unauthenticated network access with high impact (confidentiality, integrity, availability). Public metrics indicate critical severit...

Proscend Advice ICR Series routers security vulnerability

Proscend Advice ICR Series routers are a series of routers from Proscend China. A security vulnerability exists in Proscend Advice ICR Series routers that stems from the use of default credentials...

PT-2023-25769 · Proscend · Proscend Advice Icr Series

Name of the Vulnerable Software and Affected Versions: Proscend Advice ICR Series routers version 1.76 Description: The issue is related to the use of default credentials, which can be exploited. The estimated number of potentially affected devices worldwide is not specified. There is no...

CVE-2023-3703: Use of Default Credentials

Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials...

CVE-2023-41049 Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...

PT-2023-30049 · Instantsoft · Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1 Description: The issue concerns a session fixation problem. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents...