CVE-2023-49855: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3...

PT-2023-31397

Name of the Vulnerable Software and Affected Versions Menu Bar Cart Icon For WooCommerce By Binary Carpenter versions 1.49.3 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintend...

WordPress plugin Uploading SVG, WEBP and ICO files security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

ASB-A-283962802

In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress Add to Cart Text Changer and Customize Button, Add Custom Icon Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Add to Cart Text Changer and Customize Button, Add Custom Icon Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49153 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PS...

Mattermost Improper Access Control vulnerability

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the...

CVE-2023-47865

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the...

CVE-2023-47865

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the...

CVE-2023-47865 Username and Icon override can be used by members when Hardened Mode is enabled

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the...

PT-2023-30649 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to check if hardened mode is enabled when overriding the username and/or the icon when posting. If settings allow integrations to override the...

CVE-2023-47865: Improper Access Control

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the...

MAL-2023-8505 Malicious code in @tpgroup/tpg-icon-inventory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cacf2bbe7dd64c7907b4bd3e3bf524d701e8c930d3aa540683dad15d74fdd15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @tpgroup/tpg-icon-inventory

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse versions 3.1.0 through 3.1.2, which originates from potentially exhausting Redis memory by creating a website with an unusually...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2023-44271 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2023-44271 Source advisory:...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. PrestaShop themevolty v.4.0.8 version before the security vulnerability , the vulnerability stems from through...

PT-2023-31780 · WordPress · Wp Font Awesome

Name of the Vulnerable Software and Affected Versions: WP Font Awesome plugin for WordPress versions up to, and including, 1.7.9 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on the icon user-supplied...

CVE-2023-5127: Improper Neutralization of Input During Web Page Generation

The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with...

Ubuntu 16.04 ESM / 18.04 ESM : Cinnamon vulnerability (USN-4844-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4844-1 advisory. Matthias Gerstner discovered that the cinnamon-settings-users utility in Cinnamon did not safely handle symlinks. An unprivileged attacker could...

CVE-2023-4497

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Icon parameter. The XSS is loaded from /users.ghp...