AZL-29705 CVE-2023-4782 affecting package terraform for versions less than 1.3.2-19

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7...

WordPress My Account Page Editor for Woocommerce Plugin < 1.3.2 is vulnerable to Arbitrary File Upload

Software My Account Page Editor for Woocommerce Type Plugin Vulnerable versions 1.3.2 Fixed in 1.3.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-4536 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 67cdcd9b4665 Credits Alexander Concha...

WordPress Defender Security Plugin < 4.1.0 is vulnerable to Bypass Vulnerability

Software Defender Security Type Plugin Vulnerable versions 4.1.0 Fixed in 4.1.0 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-5089 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID e45ed857552b Credits Juan Pablo Gomez Postigo Required...

WordPress Laposta Signup Embed Plugin < 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Laposta Signup Embed Type Plugin Vulnerable versions 1.1.1 Fixed in 1.1.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a512250807f5 Credits Unknown Required privilege...

WordPress Media Library Assistant Plugin <= 3.09 is vulnerable to Remote Code Execution (RCE)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.09 Fixed in 3.10 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4634 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a9f84b644a17 Credits Pepitoh Required privilege...

PT-2023-27823 · F-Revocrm · F-Revocrm

Name of the Vulnerable Software and Affected Versions: F-RevoCRM versions 7.3.7 through 7.3.8 Description: The issue is an OS command injection vulnerability. If exploited, an attacker with access to the product may execute an arbitrary OS command on the server where the product is running...

DEBIAN-CVE-2023-39364

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The authchangepassword.php file accepts ref as a URL parameter and...

DEBIAN-CVE-2023-39359

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the graphs.php file. When dealing wit...

Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1775 Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability September 5, 2023 CVE Number CVE-2023-35124 SUMMARY An information disclosure vulnerability exists in the OAS Engine configuration management...

WordPress Raise Mag Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Raise Mag Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28621 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef6477e9116b Credits László Radnai Required...

WordPress WP Accessibility Helper (WAH) Plugin <= 0.6.2.4 is vulnerable to Broken Access Control

Software WP Accessibility Helper WAH Type Plugin Vulnerable versions = 0.6.2.4 Fixed in 0.6.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41869 Patch priority Low CVSS severity Low 4.3 Developer Alexander Volkov PSID e746c281667d Credits thiennv...

WordPress Super Socializer Plugin <= 7.13.54 is vulnerable to Broken Access Control

Software Super Socializer Type Plugin Vulnerable versions = 7.13.54 Fixed in 7.13.55 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-41802 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cb4e69065e0f Credits Rafshanzani Suhada...

WordPress Swifty Bar, sticky bar by WPGens Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)

Software Swifty Bar, sticky bar by WPGens Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41737 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0953a061e34a Credits Rio...

WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Restrict Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41861 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c9e5571465c1 Credits thiennv Required privile...

WordPress WordPress CTA Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress CTA Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e01853618b33 Credits István Márton Require...

WordPress WooCommerce Conversion Tracking Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Conversion Tracking Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4ebb849878be Credits...

WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload

Software Export Import Menus Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.9.0 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Upload CVE CVE-2023-34385 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 784df5b05bad Credits Emili Castells...

WordPress Product Category Showcase for WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Product Category Showcase for WooCommerce Type Plugin Vulnerable versions = 1.1.9 Fixed in 2.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e261a353a568...

WordPress User Feedback Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software User Feedback Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-39308 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4cad82df326d Credits Revan Arifio Required privilege...

Design/Logic Flaw

Certain Lexmark devices such as CS310 before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80..P246, i.e., '' indicates that the full version specification varies across product model family, but firmware level P246 or higher is required to...