CVE-2023-40676

The CVE-2023-40676 entry concerns the VeronaLabs Slimstat Analytics WordPress plugin. Affected software: Slimstat Analytics plugin versions

CVE-2023-40605 WordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor Cross-Site Scripting XSS vulnerability in 93digital Typing Effect plugin = 1.3.6 versions...

CVE-2023-40605

CVE-2023-40605 is an Authenticated (Contributor+) Cross-Site Scripting (XSS) vulnerability in the 93digital Typing Effect WordPress plugin, affecting versions up to and including 1.3.6. The issue is tied to the Typing Effect plugin and has actionable remediation: upgrade to version 1.3.7 or later...

CVE-2023-40604

CVE-2023-40604: Stored XSS in WordPress Cookies by JM plugin (admin+). Affected: Cookies by JM plugin

CVE-2023-28790 WordPress Simple Staff List Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Brett Shumaker Simple Staff List plugin = 2.2.3 versions...

CVE-2023-28790 WordPress Simple Staff List Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Brett Shumaker Simple Staff List plugin = 2.2.3 versions...

Exploit for CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin po...

The vulnerability of the auth_changepassword.php component of the Cacti network monitoring software allows a attacker to perform XSS attacks.

The vulnerability of the authchangepassword.php component of the Cacti network monitoring software is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-41949

Auth. admin+ Cross-Site Scripting XSS vulnerability in Avirtum iFolders plugin = 1.5.0 versions...

CVE-2023-41949

CVE-2023-41949 is an authenticated (admin+) Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin iFolders by Avirtum, affecting versions

Medium: tomcat

Issue Overview: A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to...

Important: ruby

Issue Overview: jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the...

Exploit for Double Free in Openbsd Openssh

OpenSSH CVE-2023-25136 Pre-Auth Double Free – Writeup and PO...

0xsodium (>=0.0.0 <=1.48.0), 3extensions (=1.0.1) +965 more potentially affected by CVE-2023-26144 via graphql (>=16.3.0 <=16.8.0)

graphql NPM version =16.3.0, =0.0.0, =0.0.1, =0.0.0, =0.0.0, =0.0.1, =1.16.13, =1.8.5, =1.1.12, =1.6.23, =1.16.6, =1.1.12, =1.8.5, =1.16.33, =1.0.0, =1.17.12-beta-20260420-075606-d7d7a9c7 and more Source cves: CVE-2023-26144 Source advisory: SNYK:JS-GRAPHQL-5905181...

PT-2023-16542 · Red Hat +1 · Openshift Console +1

Name of the Vulnerable Software and Affected Versions: OpenShift console affected versions not specified Description: A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced,...

CVE-2023-38204 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction...

Unchecked Input

Lines of code Vulnerability details Impact Attackers can get the auth badge due to unchecked input vulnerability at the LiquidityPool The wardmsg.sender badge gives the attacker the highest role in the entire Centrifuge ecosystem, allowing the attacker to steal funds and cause DOS. Proof of Conce...

Rouge ward can remove auth permission from other wards and then remove themselves

Lines of code Vulnerability details In a protocol, the deny function is used to remove the ward permissions from an address. This is actually a serious thing to consider that can actually occur, if a ward contract or account is obtained and other wards are not aware, the rogue ward can actually...

Exploit for Insecure Default Initialization of Resource in Apache Superset

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Su...

Sonicwall GMS 9.9.9320 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sonicwall', 'Description' = %q This module exploits a series of vulnerabilities - including auth bypass, SQL injection, and shell injection - to...