WordPress Events Addon for Elementor Plugin < 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Events Addon for Elementor Type Plugin Vulnerable versions 2.0.3 Fixed in 2.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2ee0a2921c21 Credits Rafie Muhammad Patchsta...

WordPress Restaurant & Cafe Addon for Elementor Plugin < 1.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant & Cafe Addon for Elementor Type Plugin Vulnerable versions 1.4.8 Fixed in 1.4.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1b34f3b56b8e Credits Rafie Muhamm...

WordPress Unlimited Theme Addon For Elementor and WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Unlimited Theme Addon For Elementor and WooCommerce Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6d5498e5f5ec...

WordPress Education Addon for Elementor Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Education Addon for Elementor Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2269d28441b4 Credits Rafie Muhammad...

CVE-2023-33989

An attacker with non-administrative authorizations in SAP NetWeaver BI CONT ADD ON - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system...

New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries

In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves. "Malicious binaries steal the user IDs, passwords, local machine...

WordPress Plugin Ultimate Addons for Gutenberg 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-32243

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1...

CVE-2023-22440

Incorrect default permissions in the IntelR SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

VulnCheck KEV: CVE-2021-43287

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting. Ensure WooCommerce is installed. Visit the following path, while logged in as an Admin: /wp-admin/admin.php?page=ppom&productmetaid=5&dometa=edit&"alert/XSS/=1...

CVE-2023-29186

In SAP NetWeaver BI CONT ADDON - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient administrative privileges then potentially critical OS files ca...

Directory traversal

In SAP NetWeaver BI CONT ADDON - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient administrative privileges then potentially critical OS files ca...

CVE-2023-29186 Directory/Path Traversal vulnerability in SAP NetWeaver.

In SAP NetWeaver BI CONT ADDON - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient administrative privileges then potentially critical OS files ca...

HkCms 代码注入漏洞

HkCms is a free open source content management system HkCms open source . HkCms version 2.2.4.230206 code injection vulnerability , the vulnerability stems from the file /admin.php/appcenter/local.html?type=addon there are problems that can lead to code injection...

PT-2023-17019 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms version 2.2.4.230206 Description: A problematic issue was found in the External Plugin Handler component, affecting an unknown part of the file /admin.php/appcenter/local.html?type=addon. This issue leads to code injection and can be...

Funadmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high quality backend development system based on ThinkPHP6 + Layui development . Funadmin v3.2.0 version has a security vulnerability , the vulnerability stems from through the component controllerAddon.php found to contain remote code execution...

PT-2023-15915 · Icplayer · Icplayer

Name of the Vulnerable Software and Affected Versions: icplayer versions up to 0.819 Description: A vulnerability was found in icplayer, affecting the function AddonText Selection create of the file addons/Text Selection/src/presenter.js. This issue leads to cross-site scripting and can be launch...

PT-2023-19775 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 3.2.0 Description: The issue is related to a remote code execution RCE vulnerability. It affects the controllerAddon.php component, allowing for potential exploitation. Recommendations: For Funadmin version 3.2.0, update to a...

icplayer 跨站脚本漏洞

icplayer is icplayer open source HTML5 player for an interactive course. A cross-site scripting vulnerability exists in versions prior to icplayer 0.820, which originated from a vulnerability found in the file addons/TextSelection/src/presenter.js has a problem with the function...