CVE-2023-1069 Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS

The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform...

CVE-2023-0491 Schedulicity - Easy Online Scheduling <= 2.21 - Contributor+ Stored XSS

The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0660 Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS

The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2023-0441 Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update

The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enab...

TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update

The plugin does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the...

PT-2023-16130 · WordPress · Nex-Forms

Name of the Vulnerable Software and Affected Versions: NEX-Forms WordPress plugin versions prior to 8.3.3 Description: The issue concerns the NEX-Forms WordPress plugin, which does not properly validate and escape some of its shortcode attributes before outputting them in a page or post. This cou...

Gallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site Scripting

The plugin does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role. PoC 1. Go to Galleries Add New. 2. Click "Add Media" and choose or upload an image. 3. When...

PT-2023-16238 · WordPress · Shortcode Menu

Name of the Vulnerable Software and Affected Versions: menu shortcode WordPress plugin version 1.0 and earlier Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its bloc...

GHSA-VJ5P-FP42-774P Moodle may display roles to users who don't have access to them

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view...

CVE-2023-1402

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view...

UBUNTU-CVE-2023-1402

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view...

CVE-2023-20059

A vulnerability in the implementation of the Cisco Network Plug-and-Play PnP agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper...

CVE-2023-28668

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fae51 and earlier grants permissions even after they've been disabled...

CVE-2023-28668

The CVE-2023-28668 entry concerns Jenkins’ Role-based Authorization Strategy Plugin. Affected: plugin version 587.v2872c41fa_e51 and earlier. Root cause: permissions can be granted and remain effective after being disabled (e.g., via script console or group assignments). Impact: attackers could g...

CVE-2023-28668

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fae51 and earlier grants permissions even after they've been disabled...

CVE-2023-28668

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fae51 and earlier grants permissions even after they've been disabled...

Cisco DNA Center 安全漏洞

Cisco DNA Center is a network management and command center service from Cisco. A security vulnerability exists in Cisco DNA Center that stems from improper integration of role-based access control RBAC with PnP...

PT-2023-21889 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 587.v2872c41fa e51 and earlier Description: The issue allows attackers to have greater access than they are entitled to after a permission is granted and then disabled. This occurs...

CVE-2023-1402 Moodle: course participation report shows roles the user should not see

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view...

Jenkins Plugins Role-based Authorization Strategy 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...