WordPress WordPress Console Plugin <= 0.3.9 is vulnerable to Broken Access Control

Software WordPress Console Type Plugin Vulnerable versions = 0.3.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-28168 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID baf6147603ae Credits Prasanna V Balaji Required...

PT-2023-2373 · Minio +2 · Minio +2

Name of the Vulnerable Software and Affected Versions: Minio versions RELEASE.2020-12-23T02-24-12Z through RELEASE.2023-03-13T19-46-17Z Description: The issue is related to a user with consoleAdmin permissions potentially creating a user that matches the root credential accessKey. Once this user ...

Malware targeting SonicWall devices could survive firmware updates

Researchers at Mandiant have identified a malware campaign targeting SonicWall SMA 100 Series appliances, thought to be of Chinese origin. The malware was likely deployed in 2021, and was able to persist on the appliances tenaciously, even surviving firmware upgrades. The malware was able to stea...

Intel® RWC 3 for Windows* Advisory

Summary: A potential security vulnerability in the Intel® RAID Web Console RWC 3 for Windows may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-14601 Description: Improper permissions in the...

CVE-2023-20064

A vulnerability in the GRand Unified Bootloader GRUB for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary comman...

Design/Logic Flaw

A vulnerability in the GRand Unified Bootloader GRUB for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary comman...

CVE-2023-20064 Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure Vulnerability

A vulnerability in the GRand Unified Bootloader GRUB for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary comman...

Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks

A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems. The flaws, tracked as CVE-2023-27898 and CVE-2023-27905, impact the Jenkins server and Update Center, and have been collectively...

CVE-2023-20064

A vulnerability in the GRand Unified Bootloader GRUB for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is due to the inclusion of unnecessary comman...

PT-2023-2264 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in the GRand Unified Bootloader GRUB for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive fil...

The vulnerability of the system entry console in the Cisco Unified Computing System (UCS) Manager, which manages the UCS 6400 and UCS 6500 routers, as well as the Cisco Nexus 9000 Series PID, allows a intruder to trigger a service failure.

The vulnerability of the system entry console in the Cisco Unified Computing System UCS Manager, which manages UCS 6400 and UCS 6500 routers and Cisco Nexus 9000 Series PIDS, is related to deficiencies in the password authentication process. Exploiting this vulnerability can allow attackers to...

Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access in Maintenance Mode

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them Run the below command in the developer console of the web browser while being on the blog as unauthenticated, when maintenance mode is...

Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update

The plugin has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user...

The vulnerability of the Console component of InHand Networks’ InRouter302 microprogramming system lies in the ability to write data beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Console component of InHand Networks’ InRouter302 microprogramming system lies in the writing of data beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cortex-XDR-Config-Extractor - Cortex XDR Config Extractor

This tool is meant to be used during Red Team Assessments and to audit the XDR Settings. With this tool its possible to parse the Database Lock Files of the Cortex XDR Agent by Palo Alto Networks and extract Agent Settings, the Hash and Salt of the Uninstall Password, as well as possible...

CVE-2023-23039

A race condition leading to a use-after-free vulnerability was found in the Linux kernel's Sun Virtual Console Concentrator VCC. This issue can result in a system crash or potential code execution if a physically proximate attacker removes a VCC device while calling open...

Keycloak vulnerable to Cross-site Scripting

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability. Details This issue is the result of code found in the exception here:...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.53 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR

The plugin does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. Run t...

CVE-2023-20012

A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender FEX when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability is due to the improper implementati...