WordPress Staff / Employee Business Directory for Active Directory Plugin < 1.2.3 is vulnerable to Broken Access Control

Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4757 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 41d386a4513c...

WordPress Slimstat Analytics Plugin <= 5.0.9 is vulnerable to SQL Injection

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-4598 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 8c9d4c888c2a Credits WordFence Required privilege Contributor...

Fedora: Security Advisory for python3.9 (FEDORA-2023-7aa64e4a41)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...

WordPress My Account Page Editor for Woocommerce Plugin < 1.3.2 is vulnerable to Arbitrary File Upload

Software My Account Page Editor for Woocommerce Type Plugin Vulnerable versions 1.3.2 Fixed in 1.3.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-4536 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 67cdcd9b4665 Credits Alexander Concha...

WordPress Auto Amazon Links Plugin <= 5.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Auto Amazon Links Type Plugin Vulnerable versions = 5.3.1 Fixed in 5.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4482 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0c8ec5425b66 Credits Marco Wotschka Require...

WordPress Defender Security Plugin < 4.1.0 is vulnerable to Bypass Vulnerability

Software Defender Security Type Plugin Vulnerable versions 4.1.0 Fixed in 4.1.0 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-5089 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID e45ed857552b Credits Juan Pablo Gomez Postigo Required...

WordPress Locatoraid Store Locator Plugin < 3.9.24 is vulnerable to Cross Site Scripting (XSS)

Software Locatoraid Store Locator Type Plugin Vulnerable versions 3.9.24 Fixed in 3.9.24 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4476 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce175b515c5f Credits Dao Xuan...

WordPress Media Library Assistant Plugin <= 3.09 is vulnerable to Remote Code Execution (RCE)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.09 Fixed in 3.10 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4634 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a9f84b644a17 Credits Pepitoh Required privilege...

Security Bulletin: IBM SDK, Java Technology Edition, Security Update August 2023

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, 8 that is used by Rational Application Developer®. These issues were disclosed as part of the IBM Java SDK updates up to August 2023. IBM 8 SR8 FP5 1.8.0371. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IB...

WordPress UniConsent Cookie Consent CMP for GDPR / CCPA Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software UniConsent Cookie Consent CMP for GDPR / CCPA Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41800 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2b359ed28a55...

WordPress WP Gallery Metabox Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Gallery Metabox Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41876 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d78bcbd51e63 Credits Skalucy Required...

WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Stagtools Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41868 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3bb564ac29eb Credits Le Ngoc Anh Required privilege...

WordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy WP Cleaner Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41697 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 515d5d148a8d Credits Mika Required privilege...

WordPress Travel Map Plugin < 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Travel Map Type Plugin Vulnerable versions 1.0.1 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41860 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 4ba841714848 Credits Mika Required privilege...

WordPress Raise Mag Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Raise Mag Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28621 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef6477e9116b Credits László Radnai Required...

WordPress Locations Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Locations Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41797 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 81c369e01ba7 Credits Rio Darmawan Required privilege...

WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Poll Maker Type Plugin Vulnerable versions = 4.7.0 Fixed in 4.7.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41871 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fe5a513df2c9 Credits Le Ngoc Anh Required privilege...

WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software PeproDev CF7 Database Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41863 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9fea5340d869 Credits RE-ALTER Required privileg...

WordPress Slider Pro Plugin <= 4.8.6 is vulnerable to Broken Access Control

Software Slider Pro Type Plugin Vulnerable versions = 4.8.6 Fixed in 4.8.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41865 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7155f5ea390e Credits Abdi Pranata Required privilege...