CVE-2022-34344

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles,...

CVE-2023-51538

Cross-Site Request Forgery CSRF vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5...

DEBIAN-CVE-2023-50979

Crypto++ aka cryptopp through 8.9.0 has a Marvin side channel during decryption with PKCS1 v1.5 padding...

ThinkAdmin Security Vulnerability

ThinkAdmin is a general purpose backend management system based on the ThinkPHP framework. A security vulnerability exists in ThinkAdmin version v6.1.53. An attacker can exploit this vulnerability to download malicious PHP files by providing a specially crafted URL to obtain a shell...

Observable Discrepancy

Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerabili...

Moodle Security Breach

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle versions prior to 4.2 through 4.2.2, 4.1 through 4.1.5, 4.0 through 4.0.10, 3.11 through...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server that stems from the presence of a directory traversal vulnerabilit...

CVE-2023-37647

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /AntSuxin.php...

CVE-2023-2561

The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the galleryremove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with th...

ThinuTech ThinuCMS 跨站脚本漏洞

ThinuTech ThinuCMS is a fast and secure PHP blogging system from ThinuTech. A cross-site scripting vulnerability exists in ThinuTech ThinuCMS version 1.5, which stems from the parameter name/body in the file /contact.php that causes cross-site scripting...

ThinuTech ThinuCMS SQL注入漏洞

ThinuTech ThinuCMS is a fast and secure PHP blogging system from ThinuTech. A SQL injection vulnerability exists in ThinuTech ThinuCMS version 1.5, which stems from the parameter catid in the file /category.php that can lead to sql injection...

cnoa OA 安全漏洞

cona cnoa OA is a collaborative office software from Hipzl cona. A security vulnerability exists in cnoa OA prior to version 5.1.1.5, which originates from the presence of an unknown function in /index.php?app=main&func=passport&action=loginf in the Telnet service component, resulting in the use ...

VulnCheck KEV: CVE-2023-30777

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins = 6.1.5 versions...

Wordpress plugin Wholesale Suite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. Wordpress plugin Wholesale Suite...

PT-2023-3724 · Wp Engine · Wp Engine Advanced Custom Fields

Name of the Vulnerable Software and Affected Versions: WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins versions 6.1.5 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability in the WP Engine Advanced Custom Fields...

GHSA-JGVC-JFGH-RJVV Chosen Ciphertext Attack in Jose4j

Summary RSA15 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA15 or RSAOAEP encrypted ciphertexts. It may be feasible to sign with affected keys. Severity Moderate - exploiting this ciphertext attack could result in the ability to decrypt RSA15 or RSAOAEP...

PT-2023-20844 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions prior to 6.21.5 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the new movie.php file. Recommendations: For versions prior to 6.21.5, update to...

GHSA-933G-V89R-X8PF Apache Dubbo vulnerable to Deserialization of Untrusted Data

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions...

CVE-2023-24258

SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request...

SUSE CVE-2006-6503

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting XSS protection by changing the src attribute of an IMG element to a javascript: URI...