PT-2023-32443 · WordPress · Post Smtp Mailer

Name of the Vulnerable Software and Affected Versions: POST SMTP Mailer WordPress plugin versions prior to 2.7.1 Description: The issue allows an unauthenticated attacker to perform XSS attacks against highly privileged users by not escaping email message content before displaying it in the...

PT-2023-23576 · Unknown · Oroplatform

Name of the Vulnerable Software and Affected Versions: OroPlatform versions prior to 5.1.1 Description: The issue affects the OroPlatform package, which is used for system and user calendar management. It allows back-office users to access information from any system calendar event, bypassing ACL...

PT-2023-30018 · WordPress · Kk Star Ratings

Name of the Vulnerable Software and Affected Versions: kk Star Ratings WordPress plugin versions prior to 5.4.6 Description: The issue allows a user to vote multiple times on a poll due to a Race Condition, as the plugin does not implement atomic operations. Recommendations: For versions prior to...

[SECURITY] [DLA 3667-1] python-requestbuilder PEP440 version update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3667-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 26, 2023 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3666-1] reportbug PEP440 version update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3666-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 26, 2023 https://wiki.debian.org/LTS -...

PT-2023-30601 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz plugin versions prior to 7.6.11 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicati...

PT-2023-30607 · WordPress · Layerslider

Name of the Vulnerable Software and Affected Versions: LayerSlider plugin versions prior to 7.7.9 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For versions prior to 7.7.9, update to versi...

PT-2023-30619 · Unknown · Themepoints Accordion

Name of the Vulnerable Software and Affected Versions: Themepoints Accordion plugin versions prior to 2.7 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For Themepoints Accordion plugin...

PT-2023-20708 · Accesspress Themes · Accesspress Themes Social Auto Poster

Name of the Vulnerable Software and Affected Versions: AccessPress Themes Social Auto Poster plugin versions = 2.1.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a...

PT-2023-30596 · WordPress · Fla-Shop.Com Interactive World Map

Name of the Vulnerable Software and Affected Versions: Fla-shop.Com Interactive World Map plugin versions prior to 3.2.0 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For versions prior to...

PT-2023-30612 · Leadster · Leadster

Name of the Vulnerable Software and Affected Versions: Leadster plugin versions prior to 1.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicatio...

PYSEC-2023-288

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

PT-2023-7683 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.109 Description: The issue is related to a use after free in CSS, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized...

PT-2023-31302 · WordPress · Pubydoc Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: PubyDoc WordPress plugin versions 2.0.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape some of...

PT-2023-30662 · WordPress · Magic Embeds

Name of the Vulnerable Software and Affected Versions: The Magic Embeds WordPress plugin versions prior to 3.1.2 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to perform...

PT-2023-8618 · Xwiki · Xwiki Admin Tools

Name of the Vulnerable Software and Affected Versions: XWiki Admin Tools versions 4.4 through 4.5.0 Description: The issue is related to insufficient authentication of executed requests in the XWiki Admin Tools application. This allows a remote attacker to execute arbitrary commands by tricking a...

PT-2023-30503 · WordPress · Labib Ahmed Image Hover Effects

Name of the Vulnerable Software and Affected Versions: Labib Ahmed Image Hover Effects – WordPress Plugin versions 5.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

OESA-2023-1840 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could acce...

emacs security update

1:26.1-11 - Bump version...

PT-2023-27013 · Unknown · Clusterpro X +3

Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 5.1 and earlier EXPRESSCLUSTER X versions 5.1 and earlier CLUSTERPRO X SingleServerSafe versions 5.1 and earlier EXPRESSCLUSTER X SingleServerSafe versions 5.1 and earlier Description: The issue allows an attacker to log...