CVE-2023-0958

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for authenticated attackers with...

Cross site request forgery (csrf)

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...

MAL-2023-386 Malicious code in fca-chat-zach (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7412bfa443afe9140f4865df0e0422e75243e8dce896fe7011126f77567f4001 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Bazaar Plugin 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

The vulnerability in the full-screen mode of the Mozilla Firefox browser, which allows a hacker to perform a spoofing attack

The vulnerability of the full-screen mode of the Mozilla Firefox browser is related to insufficient warnings about dangerous actions. Exploiting this vulnerability can allow a remote attacker to perform a spoofing attack...

Malicious code in uitk-react-action-list-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5ae6c09c0106f49a13c2a2b42ec5ae87f855fce905b95188d6645f263a17bf8 The OpenSSF Package Analysis project identified 'uitk-react-action-list-item' @ 99.99.1 npm as malicious. It is considered malicious because: -...

MAL-2023-1300 Malicious code in solodev-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1231265823e0166c738416defa7883c13c543b22ed1f2240daa1517f20908741 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-169 Malicious code in chand (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b165d316e0532d06752742211fbd52eff257064339129778ee7321ba1acda76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-26269 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 8.0.X through 8.0.34 Description: An improper privilege check in the OTRS ticket move action in the agent interface allows any authenticated attacker to perform a move of a ticket without the needed permission. Recommendations:...

PT-2023-33059 · Amazon · S2N-Quic

Name of the Vulnerable Software and Affected Versions: s2n-quic versions =v1.24.0 Description: The issue in s2n-quic causes the endpoint to shut down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected, an...

CVE-2023-3805

A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The...

PT-2023-26266 · Unknown · Xiamen Four Letter Video Surveillance Management System

Name of the Vulnerable Software and Affected Versions: Xiamen Four Letter Video Surveillance Management System versions up to 20230712 Description: A critical issue has been found in the library UserInfoAction.class of the component Login, affecting some unknown processing. This leads to improper...

CVE-2023-37164

Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the catid parameter at /shop/?module=shop&action=search...

PT-2023-26179 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue was found in the function actionExport of the component Personal Office Address Book, specifically in the file "?r=contact/default/export". This issue leads to SQL injection and can be...

The vulnerability of the Protobuf field analysis component allows a attacker to cause a service failure.

The vulnerability of the Protobuf serialization protocol field analysis component is related to performing actions in the wrong order. Exploiting this vulnerability allows a remote attacker to cause service failures...

IBOS SQL注入漏洞

IBOS is a collaborative office management system. An SQL injection vulnerability exists in IBOS OA version 4.5.5, which stems from the function actionExport in the file ?r=contact/default/export that causes sql injection...

RWS WorldServer 11.7.3 Session Token Enumeration

Advisory: Session Token Enumeration in RWS WorldServer Session tokens in RWS WorldServer have a low entropy and can be enumerated, leading to unauthorised access to user sessions. Details ======= Product: WorldServer Affected Versions: 11.7.3 and earlier versions Fixed Version: 11.8.0 Vulnerabili...

CVE-2023-3459 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hfupdatecustomer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated...

MAL-2023-931 Malicious code in ux-translation-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a1c7fc5ab29649fa65f5fbebcceb914ec5132e7c0a46b38a656b508274a5098 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Apperr – Android and iOS App builder for WooCommerce and WordPress Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Apperr – Android and iOS App builder for WooCommerce and WordPress Type Plugin Vulnerable versions = 0.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...