CVE-2023-6226

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the sumeta shortcode due to missing validation on the user controlled keys 'key' and 'postid'. This makes it possible for...

CVE-2023-6226

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the sumeta shortcode due to missing validation on the user controlled keys 'key' and 'postid'. This makes it possible for...

Input validation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the sumeta shortcode due to missing validation on the user controlled keys 'key' and 'postid'. This makes it possible for...

CVE-2023-6226 WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the sumeta shortcode due to missing validation on the user controlled keys 'key' and 'postid'. This makes it possible for...

CVE-2023-6226

CVE-2023-6226 affects the WordPress plugin WP Shortcodes Plugin – Shortcodes Ultimate, versions ≤ 5.13.3. The issue is an Insecure Direct Object Reference (IDOR) in the su_meta shortcode caused by missing validation of user-controlled keys key and post_id. This allows authenticated users with con...

CVE-2023-48121

An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x build 20230401, Ezviz CS-C6CN-xxx prior to v5.3.x build 20230401, Ezviz CS-C3N-xxx prior to v5.3.x build 20230401 allows remote attackers t...

CVE-2023-48121

CVE-2023-48121 is an authentication bypass in the Ezviz Direct Connection Module affecting Ezviz CS-C6N-xxx, CS-CV310-xxx, CS-C6CN-xxx, and CS-C3N-xxx prior to v5.3.x build 20230401. Remote attackers can obtain sensitive information by sending crafted messages to affected devices. The vulnerabili...

WordPress Shortcodes Ultimate Plugin <= 5.13.3 is vulnerable to Insecure Direct Object References (IDOR)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.13.3 Fixed in 7.0.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6226 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7b259d4a9888 Credits Francesc...

PT-2023-22122 · Unknown · Facschorus

Name of the Vulnerable Software and Affected Versions: FACSChorus affected versions not specified Description: The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, whi...

PT-2023-30706 · Ezviz +1 · Ezviz Cs-C6Cn +3

Name of the Vulnerable Software and Affected Versions: Ezviz CS-C6N-xxx versions prior to v5.3.x build 20230401 Ezviz CS-CV310-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C6CN-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C3N-xxx versions prior to v5.3.x build 20230401 Hikvision...

CVE-2023-6202 Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information e.g. name, surname, nickname via Mattermost Boards...

CVE-2023-6202 Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information e.g. name, surname, nickname via Mattermost Boards...

Sysaid Technologies SysAid Security Vulnerabilities

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A security vulnerability exists in Sysaid Technologies SysAid versions prior to 23.2.15 that stems from the presence of an insecure direct object reference IDOR issue that allows an attacker...

SUSE CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation

Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.9.25 due to missing validation on a user-controlled key. This can allow unauthenticated attackers to manipulate orders that do not belong to them...

Pre-Publish Checklist < 1.1.2 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update

Description The Pre-Publish Checklist plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.1.1 via the ppcmetaboxajaxaddhandler and ppcmetaboxajaxdeletehandler functions due to missing validation on a user controlled key. This can allow...

Youzify < 1.2.3 - Insecure Direct Object Reference

Description The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.2 due to missing validation on a user controlled key. This makes it...

The vulnerability in the drm_mode_setcrtc() function of the drivers/gpu/drm/drm_crtc.c driver module of the Linux operating system’s DRM kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failure.

The vulnerability of the drmmodesetcrtc function in the drivers/gpu/drm/drmcrtc.c file of the Linux operating system’s DRM driver module is related to the use of an uninitialized pointer. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data, compromise i...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...