1141 matches found
New Flaw in WordPress Plugin Used by Over a Million Sites Under Active Exploitation
A security vulnerability has been disclosed in the popular WordPress plugin Essential Addons for Elementor that could be potentially exploited to achieve elevated privileges on affected sites. The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that...
WordPress plugin Essential Addons for Elementor 授权问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An authorization issue vulnerabilit...
CVE-2023-32243
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
PT-2023-3024 · WordPress · Essential Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Essential Addons for Elementor versions 5.4.0 through 5.7.1 Description: An improper authentication issue exists in Essential Addons for Elementor. Exploitation of this issue may allow a remote attacker to escalate their privileges. Real-worl...
CVE-2022-45818 WordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin = 1.3.4 versions...
CVE-2022-45818
CVE-2022-45818 is a stored XSS vulnerability in the WordPress plugin Hero Banner Ultimate (
CVE-2023-0896
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access...
CVE-2023-0896
CVE-2023-0896 : Lenovo Smart Clock Essential with Alexa Built In has a default password that could allow unauthorized access by an attacker on the same local network. The CVE score is 8.8 (HIGH; AV: Adjacent, AC: Low, PR: None, UI: None, S: Unchanged; C/I/A: High). Connected sources describe a ha...
Essential Blocks < 4.0.7 - Multiple Functions Missing Authorization Checks
The plugin does not apply authorization checks on multiple sensitive functions in the plugin, making them reachable to users with low privileges like Subscribers. Additionally, its nonce validation logic can be bypassed. Affected functions include: save, get, templates, templatecount,...
PT-2023-16599 · Lenovo · Lenovo Smart Clock Essential
Name of the Vulnerable Software and Affected Versions: Lenovo Smart Clock Essential with Alexa Built In affected versions not specified Description: A default password in the device could allow unauthorized access to an attacker with local network access. Recommendations: At the moment, there is ...
Lenovo Group Ltd. Smart Clock Essential SSH hard-coded password vulnerability
Talos Vulnerability Report TALOS-2023-1692 Lenovo Group Ltd. Smart Clock Essential SSH hard-coded password vulnerability April 13, 2023 CVE Number CVE-2023-0896 SUMMARY A hard-coded password vulnerability exists in the SSH, telnet functionality of Lenovo Group Ltd. Smart Clock Essential 4.9.113. ...
CVE-2022-38077
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077 WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin = 2.2.1 versions...
CVE-2022-38077
CVE-2022-38077 is a CSRF vulnerability affecting the WP OnlineSupport / Popup Anything plugin for WordPress, in versions ≤ 2.2.1. The issue permits unauthorized cross-site requests that can be executed by an attacker due to unauthenticated access requirements. A fix has been released: upgrade to ...
[SECURITY] Fedora 38 Update: audacious-plugins-4.3-2.fc38
This package provides essential plugins for the Audacious audio player...
Wiz launches Australia cloud data center further demonstrating commitment to ANZ and multinational organizations
Wiz announces availability of new regional data center and adds support for Essential Eight controls...
project10.info Cross Site Scripting vulnerability OBB-3101238
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...