CVE-2023-5940

The WP Not Login Hide WPNLH WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-5757

The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-32306 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, ...

About the security content of macOS Ventura 13.6.3

About the security content of macOS Ventura 13.6.3 This document describes the security content of macOS Ventura 13.6.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK allows attackers to execute arbitrary commands with administrative privileges.

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands wit...

WordPress plugin Popup box security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

VulnCheck KEV: CVE-2021-27855

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this...

PT-2023-8242 · Siemens · Simatic Cn 4100

Name of the Vulnerable Software and Affected Versions: SIMATIC CN 4100 versions prior to V2.7 Description: A vulnerability has been identified in the intermediate installation process of the SIMATIC CN 4100 communication gateway, which is related to the use of default credentials with admin...

PT-2023-32210 · Tacc · Tacc Epo Extension

Name of the Vulnerable Software and Affected Versions: TACC ePO extension versions prior to 8.4.0 Description: The issue is related to an improper limitation of a path name to a restricted directory, which could allow an authorized administrator attacker to execute arbitrary code by uploading a...

Fedora 37 : kubernetes (2023-6ad09ef90b)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-6ad09ef90b advisory. Resolves CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes. Upstream change log at:...

CVE-2023-2841

The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2023-2841

The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

PT-2023-30396 · WordPress · The Ultimate Dashboard

Name of the Vulnerable Software and Affected Versions: The Ultimate Dashboard plugin for WordPress versions up to, and including, 3.7.7 Description: The issue arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-lev...

CVE-2023-5119

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a...

CVE-2023-4808

The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-5444

CVE-2023-5444 involves Trellix ePolicy Orchestrator before 5.10.0 CP1 Update 2. a CSRF allows a remote low-privilege attacker to add a new administrator user, impacting the dashboard UI. The exploit reportedly requires altering the HTTP payload post submission before it reaches the ePO server. Af...

CVE-2023-32469

Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution...

Input validation

Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution...

PT-2023-30388 · Marco Milesi · Anac Xml Viewer Plugin

Name of the Vulnerable Software and Affected Versions: Marco Milesi ANAC XML Viewer plugin versions = 1.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Marco Milesi ANAC XML Viewer...

PT-2023-30474 · WordPress · So Wp Pinyin Slugs

Name of the Vulnerable Software and Affected Versions: SO WP Pinyin Slugs plugin versions prior to 2.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For SO WP Pinyin Slugs plugin version...