WordPress Plugin Starter Templates Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-28102 · WordPress +2 · Wordpress +3

Name of the Vulnerable Software and Affected Versions: Starter Templates — Elementor, WordPress & Beaver Builder Templates versions 3.2.4 and earlier Description: A Server-Side Request Forgery SSRF issue affects the software, allowing for potential exploitation. The estimated number of potentiall...

CVE-2023-41804: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4...

com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2023-49446 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-49446 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-49446 Source...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-49375 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-49375 Source...

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: -...

com.github.zed-platform:zed-service-attachment-file (>=0.0.9, <=0.0.10), com.github.zed-platform:zed-service-document-mongo (>=0.0.8, <=0.0.10) +14 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.zed-platform:zed-service-attachment-file =0.0.9,...

de.codecentric:spring-boot-starter-batch-web (>=1.2.0.release, <=1.2.2.release), io.fabric8:process-spring-boot-container (>=1.2.0.beta1, <=1.2.0.beta3) +7 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.5.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - de.codecentric:spring-boot-starter-batch-web =1.2.0.release,...

com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1), de.codecentric:spring-boot-admin-sample (>=1.1.0, <=1.1.1) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.9.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.bushidowallet:bushido-wallet-service =1.0.0, =1.1.0,...

org.springframework.boot:spring-boot-docs (1.1.2.release), org.springframework.boot:spring-boot-starter-actuator (1.1.2.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.2.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.2.release -...

com.jdcloud.jdsf:spring-cloud-jdsf-core (1.0.0-edgware), com.taboola:async-profiler-actuator-endpoint (>=0.0.2, <=2.0.8) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.20.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.jdcloud.jdsf:spring-cloud-jdsf-core 1.0.0-edgware -...

com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway (1.5.1.release), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (1.5.1.release) +41 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.21.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway...

org.springframework.boot:spring-boot-docs (1.1.11.release), org.springframework.boot:spring-boot-starter-actuator (1.1.11.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.11.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.11.release -...

Starter Templates <= 3.2.5 - Incorrect Authorization

Description The Starter Templates free and premium plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the sseimport function in versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with...

Malicious code in starling-api-web-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70e22d8859e6bb5960333c0025707f3f3d444ff2f97f492db74c277335efa08e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in starling-api-web-starter-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8605 Malicious code in starling-api-web-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70e22d8859e6bb5960333c0025707f3f3d444ff2f97f492db74c277335efa08e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Debian DSA-5560-1 : strongswan - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5560 advisory. Florian Picca reported a bug in the charon-tkm daemon in strongSwan an IKE/IPsec suite. The TKM-backed version of the charon IKE daemon charon-tkm doesn't check the...