WordPress plugin Simplr Registration Form Plus+ security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-41368 Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)

The OData service of the S4 HANA Manage checkbook apps - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call...

PT-2023-32827 · WordPress · User Shortcodes Plus

Name of the Vulnerable Software and Affected Versions: User Shortcodes Plus plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Insecure Direct Object Reference, which affects the user meta shortcode due to missing validation on a user-controlled key. Th...

CVE-2023-41775

Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent...

CVE-2023-41775

Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent...

CVE-2023-41775

The CVE-2023-41775 entry concerns the macOS “direct” Desktop App (L is B Corp) up to version 2.6.0, where improper access control (CWE-284) potentially allows a local attacker to bypass restrictions and use the device’s camera, microphone, and related sensors without user consent. The issue is do...

PT-2023-28087 · Unknown · Direct Desktop App

Name of the Vulnerable Software and Affected Versions: direct Desktop App for macOS versions 2.6.0 and earlier Description: The issue allows a local attacker to bypass access restrictions and use the camera, microphone, etc. of the device where the product is installed without the user's consent...

CVE-2023-36123

creationtimestamp| type| source ---|---|--- 2023-09-07 12:29:43+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5095 2023-10-07 07:13:59+00:00| seen| https://t.me/cibsecurity/71771...

"direct" Desktop App for macOS fails to restrict access permissions

Overview "direct" Desktop App for macOS provided by L is B Corp. fails to restrict access permissions CWE-284. The access control mechanism provided by macOS "TCC Transparency Consent and Control" may be bypassed. Koh M. Nakagawa of FFRI Security, Inc. reported this vulnerability to IPA. JPCERT/C...

Both NetScaler HA nodes status NOT_UP after Primary HA-MON enabled interface down

There is one direct cable connectedbetween Primary node and Secondary node, The cable connection is not via switch. Both interfaces are HA MON enabled. Both NetScaler HA nodes status turn to NOTUP after Primary HA-MON enabled interface is down...

WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)

Software Sunshine Photo Cart Type Plugin Vulnerable versions 3.0.0 Fixed in 3.0.0 OWASP Top 10 A6: Security Misconfiguration Classification Insecure Direct Object References IDOR CVE CVE-2023-41796 Patch priority Low CVSS severity Low 5.3 Developer WP Sunshine PSID 684b84aa11e3 Credits yuyudhn...

PT-2023-9478 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the SPI peripheral in the Linux kernel, where sometimes RX SPI transfers with DMA enabled return corrupted data due to single or multiple bytes lost during DMA...

PT-2023-29736 · Zkteco · Zkteco Zem800

Name of the Vulnerable Software and Affected Versions: ZKTeco ZEM800 version 6.60 Description: An IDOR vulnerability has been found in the ZKTeco ZEM800 product. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or...

PT-2023-9476 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition between DMA RX transfer completion and RX FIFO drain in the Linux kernel's spi: sun6i component. This behaviour is correct when dealing with SP...

CVE-2023-38476

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin = 1.7.6 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin = 1.7.6 versions...

CVE-2023-38476

CVE-2023-38476 : Auth. (admin+) Stored XSS in the WordPress plugin “SuiteDash Direct Login” for SuiteDash :: ONE Dashboard Client Portal, affected

WordPress plugin Client Portal : SuiteDash Direct Login Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Client Portal : SuiteDash...

PT-2023-26460 · WordPress · Suitedash Direct Login

Name of the Vulnerable Software and Affected Versions: SuiteDash Direct Login plugin versions = 1.7.6 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into...

CVE-2023-2172

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeosupdatestepsajaxhandler, badgeosupdateawardstepsajaxhandler,...