GTG Product Feed for Shopping <= 1.2.4 - Unauthenticated Settings Update

Description The plugin does not have authorisation check when updating its settings, which could allow unauthenticated users to update them...

Authentication flaw

Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka as consumer and producer...

CVE-2023-36648

Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka as consumer and producer...

Burst Statistics (Free < 1.5.0, Pro < 1.5.1) - Unauthenticated SQL Injection

Description The plugins do not properly sanitise and escape the url parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated users, such as subscribers PoC curl 'https://example.com/burst-statistics-endpoint.php' \ -H 'content-type:...

CVE-2023-39909

Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application...

Code injection

Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application...

PT-2023-32309 · WordPress · Burst Statistics – Privacy-Friendly Analytics

Name of the Vulnerable Software and Affected Versions: Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro Description: The issue is related to SQL Injection via the url parameter due to insufficient...

CVE-2023-6063

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

Sql injection

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2023-6063 WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

Chamilo LMS 1.11.x < 1.11.24 Multiple Vulnerabilities

Chamilo LMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:chamilo:chamilolms"; if...

CVE-2023-5909

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect...

Code injection

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect...

CVE-2023-5909 Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect...

CVE-2023-49693

The CVE-2023-49693 entry concerns NETGEAR ProSAFE Network Management System, where Java Debug Wire Protocol (JDWP) is exposed on port 11611 and accessible without authentication, enabling remote arbitrary code execution. Multiple connected records corroborate an unauthenticated access vector via ...

CVE-2023-5604

The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress super-administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files e.g. .php, .phtml, potentially leading to remote code execution...

CVE-2023-5611

The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them...

CVE-2023-5559

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...

Design/Logic Flaw

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...

Cross site request forgery (csrf)

The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them...