WordPress BNE Testimonials Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

Software BNE Testimonials Type Plugin Vulnerable versions = 2.0.7 Fixed in 2.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24411 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d1185eecd82c Credits Rafshanzani Suhada...

WordPress Glossary Plugin <= 2.1.27 is vulnerable to Cross Site Scripting (XSS)

Software Glossary Type Plugin Vulnerable versions = 2.1.27 Fixed in 2.1.28 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24378 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7470ca4b443e Credits Rafshanzani Suhada Required...

WordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)

Software Welcart e-Commerce Type Plugin Vulnerable versions = 2.8.10 Fixed in 2.8.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22705 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 009875894ecf Credits Le Ngoc Anh...

WordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Table Manager Type Plugin Vulnerable versions = 3.5.2 Fixed in 3.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47602 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 400e13da24ca Credits Cat Required...

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Bypass Vulnerability

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-24373 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 23810638f6a6 Credi...

WordPress JobBoardWP – Job Board Listings and Submissions Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR)

Software JobBoardWP – Job Board Listings and Submissions Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23715 Patch priority Low CVSS severity Low 5.2 Developer Claim ownership PSID...

A Bootiful Podcast: GraalVM advocate Alina Yurenko on a Bootiful Podcast

Liiiive from New York, its a Bootiful Podcast! This week I @starbuxman talk to Developer Advocate for GraalVM at Oracle Labs, and legend, Alina Yurenko @alinayurenko...

GUAC - Aggregates Software Security Metadata Into A High Fidelity Graph Database

Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide and the "express interest" issue Graph for Understanding Artifact Composition GUAC aggregates software security metadata into a high fidelity graph database—normalizing entity identiti...

WordPress Juicer Plugin < 1.11 is vulnerable to Cross Site Scripting (XSS)

Software Juicer Type Plugin Vulnerable versions 1.11 Fixed in 1.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0172 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2865095a364d Credits István Márton Required privileg...

Mozilla: Malicious command could be hidden in devtools output

The Mozilla Foundation Security Advisory describes this flaw as: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within...

WordPress WP Responsive Testimonials Slider And Widget Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Responsive Testimonials Slider And Widget Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4750 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 98b84c639eda...

Attacking The Supply Chain: Developer

In this proof of concept, we look into one of several attack vectors that can be abused to attack the supply chain: targeting the developer. With a focus on the local integrated developer environment IDE, this proof considers the execution of malicious build scripts via injecting commands when th...

WordPress Post Views Count (Support caching plugins!) Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Post Views Count Support caching plugins! Type Plugin Vulnerable versions = 3.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4761 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 88e7e24c675b...

Oracle Linux 7 : thunderbird (ELSA-2023-0456)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-0456 advisory. 102.7.1-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.7.1-1 - Update to...

Riot Games compromised, new releases and patches halted

Popular game developer Riot Games brings word of a system compromise which may cause issues for updates to well known titles, although for the time being it seems as though customer data isn't affected. A social engineering development Making the notification via Twitter late last week, were stil...

WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.5 is vulnerable to Broken Access Control

Software Ultimate Addons for Beaver Builder – Lite Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23882 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 952c840a7b12 Credits...

WordPress Intuitive Custom Post Order Plugin <= 3.1.3 is vulnerable to Broken Access Control

Software Intuitive Custom Post Order Type Plugin Vulnerable versions = 3.1.3 Fixed in 3.1.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-4385 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 582d2859794c Credits Yuya Kotake...

Oracle Linux 7 : firefox (ELSA-2023-0296)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-0296 advisory. 102.7.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs....

WordPress Timed Content Plugin < 2.73 is vulnerable to Cross Site Scripting (XSS)

Software Timed Content Type Plugin Vulnerable versions 2.73 Fixed in 2.73 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0067 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0d11099524d5 Credits István Márton Required...

WordPress Youzify Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Youzify Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0059 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 066f99253e79 Credits István Márton Required...