Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

CVE-2023-3518

HashiCorp Consul and Consul Enterprise 1.16.0 had a vulnerability in JWT-based service-mesh authentication that allowed or denied access independent of service identities. The issue is fixed in version 1.16.1. No exploitation details are provided in the connected documents. Affected product/versi...

CVE-2023-3518

Removed by vendor...

CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

GHSA-9JCQ-JF57-C62C Privilege escalation via ApiTokensEndpoint

Impact An attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on https://sentry.io. For...

CVE-2023-31221

CVE-2023-31221 affects the PDQ CSV WordPress plugin (WordPress PDQ CSV) with an Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in versions = 1.0.0. Monitoring for updates is advised if further details emerge.

CVE-2023-28931

Never5 Post Connector plugin prior to 1.0.9 is affected by a Stored Cross‑Site Scripting (XSS) vulnerability requiring admin+ authentication. The issue is mitigated by upgrading to version 1.0.9 or later.

CVE-2023-28934

CVE-2023-28934 relates to a stored XSS vulnerability in the WordPress plugin WP Full Stripe Free (Mammothology WP Full Stripe Free) for versions ≤ 1.6.1. The flaw requires admin+ authentication and can be triggered via input handling within the plugin, enabling stored cross-site scripting. Public...

CVE-2023-23880

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in ExactMetrics plugin = 7.14.1 versions...

CVE-2023-23829

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pierre JEHAN Owl Carousel plugin = 0.5.3 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin = 2.3.1 versions...

CVE-2023-28773

CVE-2023-28773 affects WordPress’ Secondary Title plugin up to version 2.0.9.1, which is vulnerable to stored Cross-Site Scripting (XSS) when an authenticated Contributor interacts with the plugin. The issue is fixed in version 2.1.0. The Patchstack entry confirms vulnerable versions, the fixed r...

CVE-2023-30482 WordPress WPBulky Plugin < 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in VillaTheme WPBulky plugin = 1.0.10 versions...

CVE-2022-45821

CVE-2022-45821: Stored Cross-Site Scripting in NooTheme Noo Timetable plugin

CVE-2023-23880

CVE-2023-23880: ExactMetrics WordPress plugin

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes NS Coupon To Become Customer plugin = 1.2.2 versions...

CVE-2023-25459

CVE-2023-25459 affects the WordPress plugin Post Snippets (Postsnippets) up to v4.0.2. It is an admin-authenticated stored XSS via the snippet_content field; patch to v4.0.3. CVSS/impact details vary by source (NVD/Wordfence/Patchstack report low-to-medium risk; documented exploitation not provid...

CVE-2023-27416 WordPress Decon WP SMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Decon Digital Decon WP SMS plugin = 1.1 versions...

CVE-2023-39349

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...