WordPress InfiniteWP Client Plugin <= 1.11.1 is vulnerable to Sensitive Data Exposure

Software InfiniteWP Client Type Plugin Vulnerable versions = 1.11.1 Fixed in 1.12.1 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-2916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 88e39a11f14f Credits Lana Codes Required...

WordPress User Submitted Posts Plugin <= 20230809 is vulnerable to Cross Site Scripting (XSS)

Software User Submitted Posts Type Plugin Vulnerable versions = 20230809 Fixed in 20230811 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4308 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7067f0962238 Credits NGÔ THI...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

GHSA-CX3J-QQXJ-9597 Critters Cross-site Scripting Vulnerability

Impact Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential cross-site scripting XSS bug. Patches The bug has been fixed in v0.0.20. Workarounds Upgrading Critters version to 0.0.20 is the easiest fix. This is a non breaking version upgrade so we recommend...

WordPress flowpaper Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

Software flowpaper Type Plugin Vulnerable versions = 1.9.9 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40197 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 17268f077903 Credits Mika Required privilege...

CVE-2023-32560

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1...

CVE-2023-32565

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

CVE-2023-32560

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1...

CVE-2023-32566

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...

WordPress Fusion Builder Plugin <= 3.11.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Fusion Builder Type Plugin Vulnerable versions = 3.11.1 Fixed in 3.11.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39311 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 970dca7b1596 Credits Rafie Muhammad...

PT-2023-27338 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.174 Description: The issue allows for XSS in the app/View/Events/index.ctp file. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents wher...

WordPress Justified Gallery Plugin <= 1.7.3 is vulnerable to Broken Access Control

Software Justified Gallery Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.8.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40213 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1e36405321d9 Credits Abdi Pranata Required...

WordPress Avada Theme <= 7.11.1 is vulnerable to Arbitrary File Upload

Software Avada Type Theme Vulnerable versions = 7.11.1 Fixed in 7.11.2 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-39307 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 332539b4f8ac Credits Rafie Muhammad Patchstack Required privilege...

WordPress Advanced Custom Fields PRO Plugin 6.1-6.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.1-6.1.7 Fixed in 6.1.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c4bf4250f3b3 Credits Satoo Nakano Ryotaro Imamura Require...

WordPress ChatBot Plugin < 4.7.8 is vulnerable to Cross Site Scripting (XSS)

Software ChatBot Type Plugin Vulnerable versions 4.7.8 Fixed in 4.7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4253 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1272ce44f1e5 Credits Nguyen Hoang Nam Required privileg...

XML Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can read arbitrary files on the system by crafting malicious XML input. Remediation...

Command Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Command Injection via the command execution interface. An attacker can execute arbitrary code by injecting malicious commands into the system. This ...

WordPress Ultimate Member Plugin <= 2.6.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Member Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fecb2e61ce5f Credits WordFence Required privilege...

WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)

Software Header Footer Code Manager Type Plugin Vulnerable versions = 1.1.34 Fixed in 1.1.35 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39989 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5536fb0cce4a Credits Rafie...

WordPress Paid Memberships Pro Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Paid Memberships Pro Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 77be0838d452 Credits WordFence Required privilege...