WordPress Plugin WP EXtra Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-29910

Name of the Vulnerable Software and Affected Versions TienCOP WP EXtra versions n/a through 6.2 Description The issue is related to Missing Authorization and Cross-Site Request Forgery CSRF in TienCOP WP EXtra, allowing access to functionality not properly constrained by ACLs. This enables Cross...

PT-2023-31536

Name of the Vulnerable Software and Affected Versions Averta Shortcodes and extra features for Phlox theme versions n/a through 2.15.2 Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that...

CVE-2023-50368: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.2...

AZL-35143 CVE-2023-6507 affecting package python3 for versions less than 3.12.3-1

An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...

UBUNTU-CVE-2023-6507

An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...

PT-2023-9621

Name of the Vulnerable Software and Affected Versions CPython version 3.12.0 Description The issue is related to errors in privilege management in the subprocess module of the CPython interpreter. When using the extra groups= parameter with an empty list as a value, the logic regressed to not cal...

Python Security Vulnerabilities

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python version 3.12.0 that stems from the fact that when using the empty...

Dalmann OCPP.Core Security Vulnerability

Dalmann OCPP.Core is an OCPP Open Charge Point Protocol server written in .NET 6 by Ulrich Individual Developers. A security vulnerability exists in Dalmann OCPP.Core versions prior to 1.2.0, which stems from the server mishandling StartTransaction messages containing additional, arbitrary, or...

Ocean Extra < 2.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation

Description The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.2. This is due to missing or incorrect nonce validation on the ajaxrequiredpluginsactivate function. This makes it possible for unauthenticated attackers to...

CVE-2023-39326

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data up to about...

CVE-2023-42748

In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2023-42734

In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-42745

In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2023-42747

In camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2023-42741

In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-42742

In sysui, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges needed...

CVE-2023-42736

In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2023-42716

In telephony service, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed...

CVE-2023-42710

In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...