CKAN < 2.9.9 Multiples Vulnerabilities

According to its self-reported version number, the CKAN application running on the remote host is prior to 2.9.9 or 2.10.x prior to 2.10.1. It is, therefore, affected by multiples vulnerabilities : - An Arbitrary File Write in resourcecreate and packageupdate actions, using the ResourceUploader...

Kubernetes log information leakage vulnerability

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes secrets-store-csi-driver versions prior to 1.3.3 that stems from exposing service...

Microweber cross-site scripting vulnerabilities

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber versions prior to 2.0. An...

Over 60K Adware Apps Posing as Cracked Versions of Popular Apps Target Android Devices

Thousands of adware apps for Android have been found to masquerade as cracks or modded versions of popular applications to serve unwanted ads to users as part of a campaign ongoing since October 2022. "The campaign is designed to aggressively push adware to Android devices with the purpose to dri...

diyastore.in Cross Site Scripting vulnerability OBB-3396879

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

btctax-store (>=0.1.0, <=0.18.0), webc (>=0.4.0-rc.1, <=4.1.1) potentially affected by CVE-2023-53160 via sequoia-openpgp (1.14.0)

sequoia-openpgp CARGO version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on sequoia-openpgp and may be impacted: - btctax-store =0.1.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2023-53160 Source advisory: OSV:GHSA-25MX-8F3V-8WH7...

btctax-store (>=0.1.0, <=0.18.0), webc (>=0.4.0-rc.1, <=4.1.1) potentially affected by CVE-2023-53160 via sequoia-openpgp (1.14.0)

sequoia-openpgp CARGO version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on sequoia-openpgp and may be impacted: - btctax-store =0.1.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2023-53160 Source advisory: GHSA-25MX-8F3V-8WH7...

santangelostore.it Cross Site Scripting vulnerability OBB-3394968

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update

An update for etcd is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Cross site scripting

The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0152 WP Multi Store Locator <= 2.4 - Contributor+ Stored XSS

The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0152

CVE-2023-0152 affects the WP Multi Store Locator WordPress plugin (versions

PT-2023-16041 · WordPress · Wp Multi Store Locator

Name of the Vulnerable Software and Affected Versions: WP Multi Store Locator WordPress plugin versions prior to 2.5 Description: The issue concerns the WP Multi Store Locator WordPress plugin, which does not properly validate and escape certain shortcode attributes. This could allow users with t...

WordPress Plugin Multi Store Locator Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2023-0152: Improper Neutralization of Input During Web Page Generation

The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

secrets-store-csi-driver discloses service account tokens in logs

A security issue was discovered in secrets-store-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged...

CVE-2023-3068

A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modaladdproduct.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit...

Sql injection

A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modaladdproduct.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2023-3068 Campcodes Retro Cellphone Online Store modal_add_product.php sql injection

A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modaladdproduct.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2023-3068

CVE-2023-3068 affects Campcodes Retro Cellphone Online Store 1.0. The vulnerability is in an unknown function within /admin/modal_add_product.php where manipulation of the category parameter enables SQL injection. It is exploitable remotely and, per sources, the exploit has been disclosed. Connec...