7153 matches found
CVE-2023-21418
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact...
GHSA-V64W-49XW-QQ89 Possible user mocking that bypasses basic authentication
Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...
Possible user mocking that bypasses basic authentication
Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...
CVE-2023-48309 next-auth vulnerable to possible user mocking that bypasses basic authentication
NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...
CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added three security flaws to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation in the wild. The vulnerabilities are as follows - CVE-2023-36584 CVSS score: 5.4 - Microsoft Windows...
CVE-2023-32957
CVE-2023-32957 concerns the WordPress plugin Team Members Showcase by Dazzlersoft, affected in versions <= 1.3.4. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw, exploitable by an administrator or higher privileges via admin settings. Multiple sources corroborate ...
CVE-2023-47245
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Milesi ANAC XML Viewer plugin = 1.7 versions...
CVE-2023-47239
CVE-2023-47239 affects the WordPress plugin Scott Paterson Easy PayPal Shopping Cart (versions
CVE-2023-47240 WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin = 1.1.11 versions...
CVE-2023-47240
CVE-2023-47240 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin CBX Map for Google Map & OpenStreetMap, affecting versions ≤ 1.1.11. The issue is a stored XSS in the plugin, with vendor-supplied sources indicating a fix in version 1.1.12. Public references corro...
CVE-2023-47240 WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin = 1.1.11 versions...
CVE-2023-47242
CVE-2023-47242 refers to a Stored Cross-Site Scripting (XSS) flaw in the Marco Milesi ANAC XML Bandi di Gara WordPress plugin, affecting all releases up to and including version 7.5. The vulnerability requires Contributor+ authentication to exploit and could enable script injection under certain ...
MAL-2023-8519 Malicious code in oasis-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bbbb6d6d51b6b4eae513979526b1a1d3c7c7b9947f319737a35fe899336adfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in oasis-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bbbb6d6d51b6b4eae513979526b1a1d3c7c7b9947f319737a35fe899336adfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Multiple Critical Vulnerabilities in Juniper Exploited in the Wild
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple vulnerabilities have been discovered in Juniper Networks Junos OS, with the potential for pre-auth Remote Code Execution when chained in Juniper devices. Juniper Networks has confirmed th...
CVE-2023-47528
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sajjad Hossain Sagor WP Edit Username plugin = 1.0.5 versions...
CVE-2023-47528
CVE-2023-47528 concerns the WP Edit Username WordPress plugin (
CVE-2023-47533 WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin = 1.8.2 versions...
