PT-2023-24264 · WordPress · Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: The Custom Field For WP Job Manager WordPress plugin versions prior to 1.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is...

PT-2023-5419

Name of the Vulnerable Software and Affected Versions foreman affected versions not specified Description A command injection flaw was found in foreman, allowing an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configuratio...

PT-2023-19270 · Unknown · Webdzier Button

Name of the Vulnerable Software and Affected Versions: Webdzier Button plugin versions = 1.1.23 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Webdzier Button plugin...

Hardcoded credentials

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...

Hardcoded credentials

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password...

CVE-2023-37857 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...

CVE-2023-37857

PHOENIX CONTACT WP 6xxx series web panels are affected in versions prior to 4.0.10. An authenticated administrator can read hardcoded cryptographic keys, enabling the attacker to forge valid session cookies. However, these forged cookies are not sufficient to establish a valid session on the devi...

CVE-2023-37857 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...

CVE-2023-3569

In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service...

PT-2023-20409 · Unknown · Rigorous & Factory Pattern Dovetail Plugin

Name of the Vulnerable Software and Affected Versions: Rigorous & Factory Pattern Dovetail plugin versions 1.2.13 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Rigorous & Factory Pattern Dovetail plugin. This vulnerability requir...

PT-2023-23243 · Ransom Christofferson · Pdq Csv Plugin

Name of the Vulnerable Software and Affected Versions: Ransom Christofferson PDQ CSV plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.0....

PT-2023-19240 · Pierre Jehan · Owl Carousel

Name of the Vulnerable Software and Affected Versions: Pierre JEHAN Owl Carousel plugin versions = 0.5.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Pierre JEHAN Owl Carousel plugin...

PT-2023-22045 · WordPress · Mammothology Wp Full Stripe Free

Name of the Vulnerable Software and Affected Versions: Mammothology WP Full Stripe Free plugin versions 1.6.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Mammothology WP...

CVE-2023-3650

The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup...

PT-2023-25595 · WordPress · Bubble Menu Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Bubble Menu WordPress plugin version 3.0.4 and earlier Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

Vulnerability fixed in Ivanti Endpoint Manager

Ivanti has fixed a vulnerability in Endpoint Manager. A malicious person with administrator privileges can exploit the vulnerability exploit to execute arbitrary OS commands with, among other among other things, permissions from the tomcat process. This vulnerability is different from the...

PT-2023-26228 · WordPress · Gravity Master Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: Gravity Master Custom Field For WP Job Manager plugin versions = 1.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious...

CVE-2023-38056

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35...

CVE-2023-38056

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35...

Input validation

Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35...