Apache Tomcat 10.1.0.M1 < 10.1.16

The version of Tomcat installed on the remote host is prior to 10.1.16. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.16security-10 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from...

WordPress JetSmartFilters Plugin <= 3.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software JetSmartFilters Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48762 Patch priority Low CVSS severity Low 6.3 Developer Crocoblock PSID cc4e59f9bb8e Credits Rafie Muhammad...

WordPress JetReviews Plugin <= 2.3.2 is vulnerable to Broken Access Control

Software JetReviews Type Plugin Vulnerable versions = 2.3.2 Fixed in 2.3.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48760 Patch priority Medium CVSS severity Medium 8.2 Developer Crocoblock PSID 92a291e17f08 Credits Rafie Muhammad Patchstack...

WordPress JetTricks Plugin <= 1.4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software JetTricks Type Plugin Vulnerable versions = 1.4.6.1 Fixed in 1.4.6.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48762 Patch priority Low CVSS severity Low 6.3 Developer Crocoblock PSID 43f298a86620 Credits Rafie Muhammad Patchstack...

WordPress JetPopup Plugin <= 2.0.2 is vulnerable to Broken Access Control

Software JetPopup Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.0.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48761 Patch priority Medium CVSS severity Medium 6.3 Developer Crocoblock PSID 023e24c3cead Credits Rafie Muhammad Patchstack Require...

Apache DolphinScheduler sensitive information disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Salient Core Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48749 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ef3d6f0a3d43 Credits Rafie Muhammad Patchstack Required...

Heap overflow

An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user with the ability to load data could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19...

Heap overflow

An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint usually listening on port 8123 by default, causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are...

WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Awesome Support Type Plugin Vulnerable versions = 6.1.4 Fixed in 6.1.5 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-48323 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID afdaccd9618c Credits thiennv Required...

PT-2023-24483 · Veribase · Veribase

Name of the Vulnerable Software and Affected Versions: Veribase versions through 20231123 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The vendor was contacted...

WordPress EventPrime Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.3.2 Fixed in 3.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 97044dcaad27 Credits Unknown Required privilege Contributor...

CVE-2022-44011

An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user with the ability to load data could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19...

PT-2023-28091 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting XSS. This allows an attacker to perform cookie hijacking and log in as a...

WordPress Stripe Payments Plugin <= 2.0.79 is vulnerable to Content Injection

Software Stripe Payments Type Plugin Vulnerable versions = 2.0.79 Fixed in 2.0.80 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-48285 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d526738c5887 Credits Joshua Chan Required privilege...

WordPress Seraphinite Post .DOCX Source Plugin <= 2.16.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Seraphinite Post .DOCX Source Type Plugin Vulnerable versions = 2.16.6 Fixed in 2.16.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48279 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7c64d199da35 Credits...

PT-2023-28104 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to Improper Privilege Management, allowing a user to escalate permissions on the system shell. This enables Privilege Escalation. Recommendations: For Pandora FMS versions...

WordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection

Software ChatBot Type Plugin Vulnerable versions = 4.7.8 Fixed in 4.7.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-48741 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 1bfb272c13b3 Credits Mika Required privilege Administrator Published 23...

WordPress MyBookTable Bookstore Plugin <= 3.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software MyBookTable Bookstore Type Plugin Vulnerable versions = 3.3.4 Fixed in 3.3.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48331 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ac06dff1976c Credits Nguyen Xuan...

WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Icons Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48336 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bfc487ed2abb Credits Ngô Thiên An ancorn from VNPT-VCI...