PT-2023-4919

Name of the Vulnerable Software and Affected Versions Media Library Assistant plugin for WordPress versions up to, and including, 3.09 Description The issue is related to insufficient controls on file paths being supplied to the mla stream file parameter from the /includes/mla-stream-image.php...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2023 - Includes Oracle April 2023 CPU is vulnerable to (CVE-2023-2597)

Summary All appicable Java SE CVEs published by Oracle as part of their April 2023 Critical Patch Update, plus CVE-2023-2597. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Requirements Quality Assista...

LG LED Assistant upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation...

LG LED Assistant thumbnail Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

LG LED Assistant setThumbnailRc Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of prope...

LG LED Assistant updateFile Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of prope...

CVE-2023-39438

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

Authorization

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438

CLA-assistant’s API suffers from a missing authorization check that allows any authenticated user to perform certain operations, including reading CLA data (and signer details) and updating or deleting CLA configurations for repositories or organizations. Stored GitHub tokens are not exposed in A...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

Intel Driver and Support Assistant Cross-Site Scripting Vulnerability

Intel Driver and Support Assistant is an Intel Driver and Support Assistant application from Intel Corporation USA. The program is mainly used to detect and install system driver updates. A security vulnerability exists in Intel Driver and Support Assistant versions prior to 23.1.9. An attacker c...

CVE-2023-34010

Unauth. Reflected Cross-Site Scripting XSS vulnerability in submodule of David Lingren Media Library Assistant plugin = 3.0.7 versions...

CVE-2023-34010

Unauth. Reflected Cross-Site Scripting XSS vulnerability in submodule of David Lingren Media Library Assistant plugin = 3.0.7 versions...

CVE-2023-34010 WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in submodule of David Lingren Media Library Assistant plugin = 3.0.7 versions...

CVE-2023-34010 WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in submodule of David Lingren Media Library Assistant plugin = 3.0.7 versions...

CVE-2023-34010

CVE-2023-34010 affects WordPress Media Library Assistant plugin (submodule) up to version 3.0.7. The vulnerability is an unauthenticated reflected Cross-Site Scripting (XSS) flaw in a submodule, enabling reflected XSS without authentication. Patch available: upgrade to version 3.0.8, which fixes ...

WordPress plugin Media Library Assistant Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-9186 · D Link · D-Link Network Assistant

Name of the Vulnerable Software and Affected Versions: D-Link Network Assistant affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target...