Order Tracking Pro < 3.3.7 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape the startdate and enddate parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-29342 · WordPress · Order Tracking Pro

Name of the Vulnerable Software and Affected Versions: Order Tracking Pro plugin for WordPress versions up to, and including, 3.3.6 Description: The issue is related to Stored Cross-Site Scripting via the order status parameter due to insufficient input sanitization and output escaping. This allo...

CVE-2023-4471: Improper Neutralization of Input During Web Page Generation

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4500: Improper Neutralization of Input During Web Page Generation

The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers admin or higher to inject...

CVE-2023-4150

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

Cross site request forgery (csrf)

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

CVE-2023-4150

CVE-2023-4150 affects the WordPress plugin “User Activity Tracking and Log” (pre-4.0.9). Root cause: insufficient CSRF checks when managing the plugin license, enabling CSRF attacks to force logged-in admins to update or deactivate the license. Impact, per sources: license modification actions co...

WordPress plugin User Activity Tracking and Log: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

PT-2023-27960 · WordPress · User Activity Tracking/Log

Name of the Vulnerable Software and Affected Versions: User Activity Tracking and Log WordPress plugin versions prior to 4.0.9 Description: The issue is related to a lack of proper CSRF checks when managing the license of the plugin. This could allow attackers to make logged-in admins update and...

CVE-2023-4150: Undefined Security Weakness

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom

A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway ESG appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign. Mandiant, which i...

WordPress Order Tracking Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Order Tracking Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4471 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 29d4142f0f03 Credits Marco Wotschka...

WordPress Order Tracking Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Order Tracking Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4500 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1251cfa80c41 Credits Marco Wotschka Required...

SUSE-SU-2023:3419-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.40.5 bsc1213905: - CVE-2023-38133: Fixed information disclosure. - CVE-2023-38572: Fixed Same-Origin-Policy bypass. - CVE-2023-38592: Fixed arbitrary code execution. - CVE-2023-38594: Fixed arbitrary code execution. -...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-299)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-299 advisory. An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfssetea in...

CVE-2023-40273

creationtimestamp| type| source ---|---|--- 2023-08-23 20:12:49+00:00| seen| https://t.me/cibsecurity/69072 2023-09-04 16:03:01+00:00| seen| https://t.me/ctinow/134615 2025-01-08 08:49:08+00:00| seen| https://infosec.exchange/users/cve/statuses/113791870409998283 2025-01-08 09:12:24+00:00| seen|...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2023-37379 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2023-37379 Source advisory: OSV:GHSA-X2MH-8FMC-RQGH...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2023-40273 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2023-40273 Source advisory: OSV:GHSA-PM87-24WQ-R8W9...

data-tracking (1.7.3) potentially affected by CVE-2023-39441 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-39441 Source advisory: OSV:GHSA-5F35-PQ34-C87Q...

data-tracking (1.7.3) potentially affected by CVE-2023-40273 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-40273 Source advisory: OSV:GHSA-PM87-24WQ-R8W9...