Authorization Bypass

Overview Microsoft.IdentityModel.Protocols.SignedHttpRequest is a package that includes types that provide support for the SignedHttpRequest protocol Affected versions of this package are vulnerable to Authorization Bypass via the SignedHttpRequest protocol or the SignedHttpRequestValidator. The...

Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

Impact What kind of vulnerability is it? Who is impacted? Anyone leveraging the SignedHttpRequestprotocol or the SignedHttpRequestValidatoris vulnerable. Microsoft.IdentityModel trusts the jkuclaim by default for the SignedHttpRequestprotocol. This raises the possibility to make any remote or loc...

WordPress Customer Reviews for WooCommerce Plugin <= 5.38.9 is vulnerable to Arbitrary File Upload

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.38.9 Fixed in 5.38.10 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6979 Patch priority Medium CVSS severity Medium 9.8 Developer Claim ownership PSID f2b42bb42f3b Credits Artem Guzhva...

WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.3.0 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-7068 Patch priority Low CVSS severity Low 4.3 Developer Claim...

WordPress WooCommerce Conversion Tracking Plugin <= 2.0.11 is vulnerable to Broken Access Control

Software WooCommerce Conversion Tracking Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52217 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 83cd471b97c1 Credits Abdi...

WordPress WooCommerce Warranty Requests Plugin <= 2.2.7 is vulnerable to Broken Access Control

Software WooCommerce Warranty Requests Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51496 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID d88a3c131398 Credits Rafie...

WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e48c62e620dc Credits Huynh Tien Si Required privilege...

WordPress Quotes for WooCommerce Plugin <= 2.0.1 is vulnerable to Broken Access Control

Software Quotes for WooCommerce Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51680 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ace2b6bbf64b Credits Abdi Pranata Required...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Privilege Escalation

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51472 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9fb8ab95cc18 Credits...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Settings Change

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51471 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID cfce7b38ed64 Credits Rafie Muhammad Patchstack...

WordPress Quiz And Survey Master Plugin <= 8.1.16 is vulnerable to Broken Access Control

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.1.16 Fixed in 8.1.17 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51507 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a01b6a13b8b9 Credits Revan Arifio Require...

WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Type Plugin Vulnerable versions 9.7.4 Fixed in 9.7.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51520 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fef569558e95 Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.20 Fixed in 6.21 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51535 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection

Software Fluent Support Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-51547 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 5aa5f4266c5e Credits Yudistira Arya Required privilege Administrator...

WordPress CBX Bookmark & Favorite Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)

Software CBX Bookmark & Favorite Type Plugin Vulnerable versions = 1.7.13 Fixed in 1.7.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51514 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8b970dcc1144 Credits Ngô Thiên An ancorn from...

WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

WordPress ProjectHuddle Client Site Plugin <= 1.0.34 is vulnerable to Broken Access Control

Software ProjectHuddle Client Site Type Plugin Vulnerable versions = 1.0.34 Fixed in 1.0.35 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51376 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 662f316bbcd6 Credits Rafie...

WordPress User Feedback Plugin <= 1.0.10 is vulnerable to Broken Access Control

Software User Feedback Type Plugin Vulnerable versions = 1.0.10 Fixed in 1.0.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50887 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 72613a1d0e22 Credits Revan Arifio Required privile...

WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)

Software Amelia Type Plugin Vulnerable versions = 1.0.85 Fixed in 1.0.86 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50860 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 27837f5455f3 Credits Ngô Thiên An ancorn from VNPT-VCI Required...