CVE-2023-6187

CVE-2023-6187 — Paid Memberships Pro (WordPress) Product: Paid Memberships Pro plugin for WordPress. Affected versions: up to 2.12.3. Vulnerability: Arbitrary file upload due to insufficient validation in pmpro_paypalexpress_session_vars_for_user_fields. This can allow an authenticated user with ...

PT-2023-32556 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro plugin for WordPress versions up to, and including, 2.12.3 Description: The issue arises from insufficient file type validation in the pmpro paypalexpress session vars for user fields function. This allows authenticated...

Linux kernel buffer error vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a buffer error vulnerability that stems from an out-of-bounds read vulnerability in the NVMe of/TCP subsystem...

kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error device address=0x00000002a3ff38d8...

kernel: Linux kernel: Integer overflow in iwlwifi debugfs function

A flaw was identified in the Linux kernel’s iwlwifi PCIe driver. In the function iwlwritetouserbuf—which is invoked by iwldbgfsmonitordataread—an attacker could supply a specially crafted count value e.g., SIZEMAX. This leads to an integer overflow when calculating the remaining buffer space,...

express-transporte.at Improper Access Control vulnerability OBB-3779714

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-45810

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a throu...

CVE-2022-45810

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a throu...

Input validation

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a throu...

CVE-2022-45810

CVE-2022-45810 affects the Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce plugin. The root cause is improper neutralization of formula elements in a CSV file (CSV injection) that leads to unauthorized data handling via unauthenticated access over a netwo...

CVE-2022-45810 WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a throu...

kernel: drivers/perf: hisi: Don't migrate perf to the CPU going to teardown

A logic error was found in the Linux kernel's HiSilicon PCIe performance monitoring driver in the CPU offline handling path. A local user can trigger this issue during CPU hotplug operations when the driver migrates performance monitoring context, potentially selecting the CPU being torn down as...

kernel: veth: Fix use after free in XDP_REDIRECT

A use-after-free vulnerability has been identified within the vethconvertskbtoxdpbuff function of the Linux kernel's veth driver. The flaw stems from improper memory management during packet headroom expansion for XDP eXpress Data Path. Specifically, when the pskbexpandhead function allocates new...

PT-2023-14762 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce versions through 5.5.2 Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects Icegram Express...

CVE-2022-45810: Improper Neutralization of Formula Elements in a CSV File

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a throu...

WordPress Plugin Icegram Express Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

SUSE CVE-2022-24999

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...

WordPress Icegram Express Plugin < 5.6.24 Path Traversal Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:icegram:emailsubscribers%26newsletters"; if description...

WordPress Icegram Express Plugin < 5.5.1 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:icegram:emailsubscribers%26newsletters"; if description...

CVE-2023-5414

The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the showeslogs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including...