Rocky Linux 9 : firefox (RLSA-2023:6188)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6188 advisory. - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 - It was possible for certain browser prompts an...

VulnCheck KEV: CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2023-43984

Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the pscustomer table...

CVE-2023-46001

Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isomread.c:2807:51 function in gfisomgetuserdata...

WordPress Plugin Amazonify Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress Plugin Telephone Number Linker Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Plugin Social Sharing Plugin - Social Warfare Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-29059 · Smartisoft · Advancedexport

Name of the Vulnerable Software and Affected Versions: Smart Soft advancedexport versions prior to 4.4.7 Description: The issue is related to insecure permissions in the advancedexport module, allowing unauthenticated attackers to download user information from the ps customer table...

PT-2023-30473 · WordPress · Wpsolutions-Hq Wpdbspringclean

Name of the Vulnerable Software and Affected Versions: WPSolutions-HQ WPDBSpringClean plugin versions 1.6 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-6964 · Unknown +2 · Gpac Mp4Box +2

Name of the Vulnerable Software and Affected Versions: gpac MP4Box version 2.3-DEV-rev573-g201320819-master Description: The issue is caused by a buffer overflow in the gf isom get user data function, which can be exploited by a local attacker to cause a denial of service. This buffer overflow...

Design/Logic Flaw

A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks,...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication mechanisms. This allows attackers to access information about arbitrary user accounts.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor to access and disclose information about arbitrary user...

PYSEC-2023-230

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

UBUNTU-CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

PT-2023-29955 · WordPress · Zotpress

Name of the Vulnerable Software and Affected Versions: Katie Seaborn Zotpress plugin versions prior to 7.3.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

Oracle Linux 8 : firefox (ELSA-2023-6187)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6187 advisory. - Add fix for CVE-2023-44488 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...