JVN#59341308: WordPress Plugin "Newsletter" vulnerable to cross-site scripting

WordPress Plugin "Newsletter" provided by Stefano Lissa & The Newsletter Team contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is logging in to the WordPress using the plugin. Solution Update the plugin Update the...

WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 2.25.3 Fixed in 2.26.0 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-32513 Patch priority High CVSS severity High 7.5 Developer Liquid Web / StellarWP PSID 8e6fd83cfd05 Credits Rafie Muhammad Patchstack Required...

WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Order Your Posts Manually Type Plugin Vulnerable versions = 2.2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32510 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fdf3da041b8c Credits minhtuana...

KLA49157 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in SysInternals Sysmon for Windows can be...

WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Broken Access Control

Software Woo Custom Emails Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32507 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID d401968a61b0 Credits minhtuanact Required privileg...

WordPress wordpress vertical image slider plugin Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Software wordpress vertical image slider plugin Type Plugin Vulnerable versions = 1.2.16 Fixed in 1.2.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24413 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID da3e59a78609...

WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.7 is vulnerable to Broken Access Control

Software TK Google Fonts GDPR Compliant Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID a16b5d1818ee Credits Unknown Required...

WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Abstracts Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29385 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID eb9850af3b46 Credits LEE SE HYOUNG...

WordPress TheGem (Elementor) Theme < 5.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software TheGem Elementor Type Theme Vulnerable versions 5.8.1.1 Fixed in 5.8.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32237 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 54db6f410b09 Credits Dave Jong Patchstack...

WordPress Points and Rewards for WooCommerce Plugin <= 1.5.0 is vulnerable to Broken Access Control

Software Points and Rewards for WooCommerce Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-27608 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9fa3c23ff647 Credits Dave...

WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Booking Ultra Pro Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32236 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 00fb8bbc9f88 Credits Team WeBoB...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.3.0 is vulnerable to Broken Access Control

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1843 Patch priority High CVSS severity High 6.5 Developer Wpmet PSID b16a58b44328 Credits Marco Wotschka...

A Bootiful Podcast: Java Champion Ken Kousen on Gradle, Java, Kotlin, Mockito, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion Ken Kousen @kenkousen, live from the Great International Developer Summit 2023 in beautiful Bangalore, India, about Gradle, the Kotlin DSL, Java, and so much more Check out Ken's awesome Youtube channel...

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Other Vulnerability Type

Software Multi Rating Type Plugin Vulnerable versions = 5.0.6 Fixed in N/A OWASP Top 10 A1: Injection Classification Other Vulnerability Type CVE CVE-2023-32127 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 84e75518f454 Credits yuyudhn Required privilege Unauthenticated...

WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Arbitrary File Upload

Software Manager for Icomoon Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-29386 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 0add1822a9fe Credits deokhunKim Required privilege Administrat...

WordPress WPO365 | Mail Integration for Office 365 / Outlook Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

Software WPO365 | Mail Integration for Office 365 / Outlook Type Plugin Vulnerable versions = 1.9.0 Fixed in 1.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32119 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID...

CVE-2023-2069

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables...

Design/Logic Flaw

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables...

UBUNTU-CVE-2023-2069

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from the fact that a us...