Code injection

Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted...

CVE-2023-41945

The CVE-2023-41945 issue affects the Jenkins Assembla Auth Plugin (versions ≤ 1.14). Root cause: the plugin does not verify that permissions it grants are actually enabled, allowing users with EDIT to receive Overall/Manage and Overall/SystemRead permissions even when disabled. Impact: elevated p...

CVE-2023-41945

Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted...

CVE-2023-40007

CVE-2023-40007 affects the WordPress plugin CT Commerce (versions

CVE-2023-40329

CVE-2023-40329 affects the WordPress plugin WPZest Custom Admin Login Page (WPZest) up to version 1.2.0. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw, where user input in admin settings is not properly validated/escaped, enabling XSS with admin privileges. Several ...

kernel: buffer overflow in ceph file net/ceph/messenger_v2.c

An flaw was found in net/ceph/messengerv2.c in the Linux Kernel. An integer signing error leads to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This issue occurs due to an untrusted length taken from a TCP packet in cephdecode32...

The vulnerability of the Red Hat Ansible configuration management system lies in the lack of protective measures for SQL query structures, allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the Red Hat Ansible configuration management system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of the protected information by using the...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Devaldi Ltd flowpaper plugin = 1.9.9 versions...

CVE-2023-32578

CVE-2023-32578 is a Stored XSS against Twinpictures Column-Matic plugin

CVE-2023-40206

Summary: CVE-2023-40206 is an authenticated stored XSS vulnerability in the hwk-fr WP 404 Auto Redirect to Similar Post plugin (

CVE-2023-37393

CVE-2023-37393 is a stored XSS vulnerability in the WordPress plugin Atarim Visual Website Collaboration, Feedback & Project Management – Atarim (versions 3.9.3 (Patchstack notes fixed in 3.9.4). If upgrading is not immediately possible, apply mitigations per vendor guidance and monitor for upda...

CVE-2023-37393 WordPress Atarim Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.9.3 versions...

CVE-2023-39987

CVE-2023-39987 is an authenticated stored XSS in the WordPress wSecure Lite plugin (

CVE-2023-36382

CVE-2023-36382 corresponds to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Jeffrey-WP Media Library Categories (versions ≤ 2.0.0). The issue arises from an input/output handling flaw in the plugin’s category functionality, enabling an admin+ caller to i...

CVE-2023-38476

CVE-2023-38476 : Auth. (admin+) Stored XSS in the WordPress plugin “SuiteDash Direct Login” for SuiteDash :: ONE Dashboard Client Portal, affected

PoC Exploit Released for Critical VMware Aria's SSH Auth Bypass Vulnerability

Proof-of-concept PoC exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks formerly vRealize Network Insight. The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been describe...

CVE-2023-34011 WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ShopConstruct plugin = 1.1.2 versions...

CVE-2023-25042

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Liam Gladdy Storm Consultancy oAuth Twitter Feed for Developers plugin = 2.3.0 versions...

CVE-2023-37986

CVE-2023-37986 affects the miniOrange YourMembership Single Sign On (YM SSO) Login WordPress plugin, versions

CVE-2023-25488

CVE-2023-25488 applies to the WordPress plugin WP Default Feature Image . The connected sources describe a Stored Cross-Site Scripting (XSS) vulnerability that affects versions up to and including 1.0.1.1 . The root cause is an input/processing flaw in the plugin’s default feature image handling ...