aldryn-django (>=4.2.10.0 <=4.2.18.0), alertwise (=1.0.0) +114 more potentially affected by CVE-2023-36053 via django (>=4.2.0 <=4.2.29)

django PYPI version =4.2.0, =4.2.10.0, =65.10.0, =7.5.1, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.8.0, =0.0.4.dev0, =8.0.0, =8.5.1 and more Source cves: CVE-2023-36053 Source advisory: OSV:GHSA-JH3W-4VVF-MJGR...

CVE-2023-26258

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute a...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 9

New Red Hat Single Sign-On 7.6.4 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 9 : Red Hat Single Sign-On 7.6.4 security update on RHEL 9 (Important) (RHSA-2023:3885)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3885 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 7 : Red Hat Single Sign-On 7.6.4 security update on RHEL 7 (Important) (RHSA-2023:3883)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3883 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.6.4 security update on RHEL 8 (Important) (RHSA-2023:3884)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3884 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

CVE-2023-32523

Affected versions of Trend Micro Mobile Security Enterprise 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2023-29437

The CVE-2023-29437 entry corresponds to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Connections Business Directory plugin, affecting versions 10.4.36, specifically 10.4.37 or later. Patch sources indicate a low-severity issue with low likelihood of exploitation. No exploit...

CVE-2023-29435 WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...

CVE-2023-29435

CVE-2023-29435 : Auth. (contributor+) Stored Cross-Site Scripting (XSS) in the WordPress plugin “Cryptocurrency All-in-One” (WordPress Cryptocurrency All-in-One Plugin) up to version 3.0.19. Public data confirms the vulnerable component is the plugin; root cause is stored XSS as stated, with an a...

CVE-2023-29424 WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Plainware ShiftController Employee Shift Scheduling plugin = 4.9.23 versions...

CVE-2023-28991

CVE-2023-28991 corresponds to a Stored XSS vulnerability in the PI Websolution Order date, Order pickup, Order date time, Pickup Location, and delivery date components of the WP plugin for WooCommerce, affected

CVE-2023-28991 WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce plugin = 3.0.19 versions...

CVE-2023-28988

CVE-2023-28988 concerns the WordPress plugin “Direct checkout, Add to cart redirect for WooCommerce” (PI Websolution) for WooCommerce. Affected: plugin versions ≤ 2.1.48. Nature: Authenticated Stored Cross-Site Scripting (XSS) vulnerability present in multiple UI elements (Direct checkout, Add to...

CVE-2023-28988 WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin = 2.1.48 versions...

CVE-2023-28751

CVE-2023-28751 affects WP Ultimate Review (Wpmet) plugin

CVE-2023-27427

CVE-2023-27427 concerns the WordPress NTZApps CRM Memberships plugin (

CVE-2023-32580

CVE-2023-32580 affects the WordPress plugin “Password Protected” (WPExperts) ≤ 2.6.2. The issue is an authenticated (admin+) Stored Cross‑Site Scripting (XSS) vulnerability, enabling script injection via the plugin’s handling of input when already logged in as an administrator. Multiple sources c...

CVE-2023-35048 WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin = 1.2.1 versions...

Sql injection

A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain...