CVE-2023-6600

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the updatesettings function hooked via admininit in all versions up to, and including, 5.7.9. Th...

CVE-2023-39157

Improper Control of Generation of Code 'Code Injection' vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10...

CVE-2023-50878

Cross-Site Request Forgery CSRF vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1...

CVE-2023-25054

Improper Control of Generation of Code 'Code Injection' vulnerability in David F. Carr RSVPMaker.This issue affects RSVPMaker: from n/a through 10.6.6...

PT-2023-32883 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 2.10.0 and earlier Description: The issue allows an attacker to perform CSRF attacks against the server due to the failure to sanitize deeplink paths. Recommendations: For Mattermost versions 2.10.0 and earlier, update to ...

PT-2023-31801 · Unknown · Sandbox Accounts For Events

Name of the Vulnerable Software and Affected Versions: Sandbox Accounts for Events versions prior to 1.10.0 Description: The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events,...

automad Cross-Site Request Forgery Vulnerability

automad is a flat file content management system and template engine. A cross-site request forgery vulnerability exists in automad 1.10.9 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the User Creation Handler component...

WordPress plugin Menu Image, Icons made easy Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Menu Image, Icons made eas...

Microsoft Windows Security Vulnerabilities

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation. A security vulnerability exists in Microsoft Windows Local Session Manager. The following products and editions are affected: Windows 10 Version 21H1,Windows Server 2022,Window...

PT-2023-31100 · Unknown · Fabio Marzocca List All Posts By Authors

Name of the Vulnerable Software and Affected Versions: Fabio Marzocca List all posts by Authors, nested Categories and Titles versions 2.7.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allo...

CVE-2023-49173

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10to8 Sign In Scheduling Online Appointment Booking System allows Stored XSS.This issue affects Sign In Scheduling Online Appointment Booking System: from n/a through 1.0.9...

UBUNTU-CVE-2023-46727

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory...

UBUNTU-CVE-2023-46726

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue...

Incorrect Authorization

Overview UmbracoCms.Web is an ASP.NET CMS. Affected versions of this package are vulnerable to Incorrect Authorization due to improper access control mechanisms. An attacker can gain access to unauthorized functionalities or data by exploiting the endpoints that are not adequately secured...

Exposure of Sensitive Information

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information via a brute force attack. An attacker can collect valid usernames by repeatedly attempting to authenticate with different usernames. Remediation Upgrade Umbraco.Cms to version 10.8.1, 12.3.4 or higher...

Microsoft Windows Telephony Server Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Telephony Server. An attacker could exploit the vulnerability to elevate privileges. The following products and...

VulnCheck KEV: CVE-2021-22214

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited...

Microsoft Windows Internet Connection Sharing (ICS) security vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Internet Connection Sharing ICS. An attacker could exploit this vulnerability to cause a denial of service on the...

Opencast Security Vulnerabilities

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. A security vulnerability exists in Opencast versions 4.x through 10.x prior to 10.6, which originates from sending system digest credentials during an...

CVE-2023-28527

IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206...