WordPress WP Post Rating Plugin <= 2.5 is vulnerable to Other Vulnerability Type

Software WP Post Rating Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Other Vulnerability Type CVE CVE-2023-25785 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7223c21edad9 Credits yuyudhn Required privilege Unauthenticated...

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Multi Rating Type Plugin Vulnerable versions = 5.0.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47433 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dedf07346191 Credits minhtuanact Required...

Upgraded Q -> 2 from #250 [1676238307490]

Judge has assessed an item in Issue 250 as 2 risk. The relevant finding follows: In first place, currentIndex which is of type mappingaddress = uint256 is incremented before using it in line 117. This will cause the implementation to miss the zero index, and start from the second place index 1. T...

Multi Rating < 5.0.6 - Ratings Deletion via CSRF

The plugin does not have CSRF check when deleting ratings, which could allow attackers to make logged in admins to perform such action via a CSRF attack...

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Broken Access Control

Software Multi Rating Type Plugin Vulnerable versions = 5.0.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25053 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 49ce4d920ef6 Credits minhtuanact Required privilege...

WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Rating Type Plugin Vulnerable versions = 5.0.5 Fixed in 5.0.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47443 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1dcbbd6b8544 Credits rezaduty Required...

WordPress Reviews and Rating – Google My Business Plugin <= 4.14 is vulnerable to Broken Access Control

Software Reviews and Rating – Google My Business Type Plugin Vulnerable versions = 4.14 Fixed in 4.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23986 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 7be60ef76311 Credits István...

WordPress Universal Star Rating Plugin <= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Universal Star Rating Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1a388ca6e1a9 Credits Mika Required...

libqb bug fix and enhancement update

An update is available for libqb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libqb packages provide a library with the primary purpose of providing high...

zlib bug fix and enhancement update

An update is available for zlib. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The zlib packages provide a general-purpose lossless data compression library th...

stalld bug fix and enhancement update

An update is available for stalld. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The stalld package provides a mechanism used to prevent the starvation of...

Rate my Post – WP Rating System < 3.3.9 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Exploit shortcode: ratemypost-result id='" onmouseover="alert1"'...

.NET 7.0 bugfix update

An update is available for dotnet7.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

CVE-2022-4399

A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c. The manipulation of the argument value/name leads to sql injection. The name of the patch is 7a7d737a3929f335b9717ddbd31db91151b69ad2. It ...

Security update for python-slixmpp (moderate)

openSUSE Security Update: Security update for python-slixmpp Announcement ID: openSUSE-SU-2022:10241-1 Rating: moderate References: 1205433 Cross-References: CVE-2022-45197 Affected Products: openSUSE Backports SLE-15-SP3 An update that fixes one vulnerability is now available. Description: This...

Update now! Emergency fix for Google Chrome's V8 JavaScript engine zero-day flaw released

On Friday, December 2, Google rolled out an out-of-band patch for an actively exploited zero-day vulnerability in its V8 JavaScript engine. The flaw could allow attackers to cause a system crash or execute potentially malicious code. That means you'll want to update Chrome to patch against this...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-45842

Unauth. Race Condition vulnerability in WP ULike Plugin = 4.6.4 on WordPress allows attackers to increase/decrease rating scores...

WordPress plugin WP Ulike 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2022-27655 · WordPress · Wp Ulike Plugin

Name of the Vulnerable Software and Affected Versions: WP ULike Plugin versions = 4.6.4 Description: The issue allows attackers to manipulate rating scores by exploiting a race condition vulnerability. This can result in increased or decreased rating scores. Recommendations: For WP ULike Plugin...