PT-2023-9608 · Oracle · Peoplesoft Enterprise Elm Enterprise Learning Management

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise ELM Enterprise Learning Management version 9.2 Description: The issue is related to a vulnerability in the authorization procedure of the Enterprise Learning Management component. This vulnerability allows a low-privileg...

PT-2023-9320 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.8.2 Description: The issue is related to insufficient input validation in the Web Runtime SEC component. It allows an unauthenticated attacker with network access via HTTP to compromise JD...

Enhanced Text Widget <= 1.6.2 - Missing Authorization via etw_hide_admin_notification_callback

Description The Enhanced Text Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the etwhideadminnotificationcallback function in versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to hide adm...

PT-2023-26827 · Senec +1 · Storage Box V1 +3

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows a remote unauthenticated attacker to capture and modify network traffic because sensitive information is transmitted unencrypted. Recommendations: At the moment, there is ...

PT-2023-25678

Name of the Vulnerable Software and Affected Versions CartFlows Pro versions 1.11.12 and earlier Description A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This can lead to various security problems, including data modification or...

Export WP Page to Static HTML/CSS < 2.2.0 - Missing Authorization via Multiple AJAX Actions

Description The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers,...

Laposta Signup Basic < 1.4.2 - Missing Authorization

Description The Laposta Signup Basic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxResetCache function in versions up to, and including, 1.4.1. This makes it possible for subscriber-level attackers or higher to delete the...

CVE-2023-29065

The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database...

Preloader for Website < 1.3 - Missing Authorization via plwao_register_settings()

Description The Preloader for Website plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the plwaoregistersettings function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to reset the plugin's...

CVE-2023-29066: Incorrect Privilege Assignment

The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders...

MultiVendorX < 4.0.26 - Improper Authorization on REST Routes via 'save_settings_permission'

Description The MultiVendorX plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on the 'savesettingspermission' function for the REST routes instantiated by the 'mvxrestroutesreactmodule' function versions ...

Legal Pages < 1.3.8 - Missing Authorization on 'deleteLegalTemplate'

Description The Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteLegalTemplate function in versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with subscriber-level access and...

Unyson <= 2.7.28 - Missing Authorization

Description The Unyson plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions in versions up to, and including, 2.7.28. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Jetpack < 12.7 - Improper Authorization via WPCom External Media REST endpoints

Description The Jetpack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the WPCom External Media REST permissioncallback function in versions up to and including 12.6.2. This makes it possible for authenticated attackers, with...

Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization in Reviews Exporter

Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the checkprogress and cancelexport functions in versions up to, and including, 5.36.0. This makes it possible for...

Better Elementor Addons <= 1.3.6 - Missing Authorization

Description The Better Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the beaadminajax function hooked via an AJAX action in versions up to, and including, 1.3.6. This makes it possible for authenticated attackers, wit...

Short URL <= 1.6.8 - Missing Authorization via multiple AJAX functions

Description The Short URL plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 1.6.8. This makes it possible for authenticated attackers such as...

Convertful – Your Ultimate On-Site Conversion Tool < 2.6 - Missing Authorization via add_woo_coupon

Description The Convertful – Your Ultimate On-Site Conversion Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'addwoocoupon' REST function in versions up to, and including, 2.5. This makes it possible for unauthenticated...

WRC Pricing Tables < 2.3.8 - Missing Authorization

Description The WRC Pricing Tables plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on several functions including wrcptprocesspackagefeatures, wrcpteditpricingpackages, wrcptactivatetemplate and others in versions up to, and including, 2.3.7...

Funnelforms Free < 3.4.2 - Missing Authorization to Arbitrary Post Duplication

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfcopyposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...