Incorrect Control Flow Implementation

vyper is vulnerable to Incorrect Control Flow Implementation. The vulnerability exists in functions.py due to incorrect implementation of operations causing side effects which allows an attacker to perform unauthorized actions...

Authorization Bypass

github.com/usememos/memos is vulnerable to Authorization Bypass. The vulnerability exists in JWTMiddleware function at jwt.go due to improper handling of JWT tokens which allows an attacker to perform unauthorized actions...

PT-2023-36258 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The update rebuilds the container-suseconnect package with this security release. No information is provided...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in the lack of proper warnings about dangerous actions, allowing attackers to upload arbitrary files.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to insufficient warnings about dangerous actions. Exploiting these vulnerabilities allows a remote attacker to upload arbitrary files...

PT-2023-23707 · Woocommerce · Kangu Para Woocommerce

Name of the Vulnerable Software and Affected Versions: Kangu para WooCommerce plugin versions = 2.2.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website,...

Cisco APIC Unauthorized Policy Actions (cisco-sa-apic-uapa-F4TAShk)

A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to read, modify, or delete non-tenant policies for example, access policies created by users associated with a different securi...

CVE-2023-4000

The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to create and delete countdown...

CVE-2023-2279

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

Cross site request forgery (csrf)

The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to create and delete countdown...

CVE-2023-4000 Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery

The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to create and delete countdown...

PT-2023-27200 · WordPress · The Waiting

Name of the Vulnerable Software and Affected Versions: The Waiting: One-click countdowns plugin for WordPress versions up to, and including, 0.6.2 Description: The issue is due to missing or incorrect nonce validation on its AJAX actions, making it possible for unauthenticated attackers to create...

CVE-2023-4209

The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks...

PT-2023-24034 · WordPress · Woocommerce Composite Products

Name of the Vulnerable Software and Affected Versions: WooCommerce Composite Products plugin versions = 8.7.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on a user's browser,...

PT-2023-24712 · Unknown · Bbs E-Popup

Name of the Vulnerable Software and Affected Versions: BBS e-Theme BBS e-Popup plugin versions = 2.4.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website,...

PT-2023-24714 · WordPress · Chilexpress Chilexpress Woo Oficial Plugin

Name of the Vulnerable Software and Affected Versions: Chilexpress Chilexpress woo oficial plugin versions 1.2.9 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on the...

PT-2023-24627 · Wedevs · Wedevs Wp Erp

Name of the Vulnerable Software and Affected Versions: weDevs WP ERP plugin versions = 1.12.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to unauthorized...

PT-2023-33030 · Facebook · Pytorch

Name of the Vulnerable Software and Affected Versions: pytorch/pytorch affected versions not specified Description: The filter-test-configs workflow in pytorch/pytorch is vulnerable to an expression injection in Actions. This allows an attacker to potentially leak secrets and alter the repository...

PT-2023-28262 · WordPress · Poeditor

Name of the Vulnerable Software and Affected Versions: POEditor WordPress plugin versions prior to 0.9.8 Description: The issue is related to the lack of CSRF checks in various places within the plugin, allowing attackers to perform unwanted actions on logged-in admins, such as resetting the...

Privilege Escalation

github.com/gravitl/netmaker is vulnerable to Privilege Escalation. The vulnerability exists due to improper permission validation for non-admin users, which allows an attacker to perform authorized actions on users, such as changing roles...

Google strengthens its Workplace suite protection

Google has announced the strengthening of safeguard measures for its Workspace customers. You may well be using Workspace without realising it. If youre using a Google product such as Gmail, Calendar, Drive, or Google Docs Editors Suite among other apps, then congratulations: you are fully inside...