WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software MakeStories for Google Web Stories Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.0.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27448 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 422c8d1d0b2a Credits...

CVE-2023-40182 silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not

Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7...

CVE-2023-40577 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

WordPress URL Shortify Plugin < 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software URL Shortify Type Plugin Vulnerable versions 1.7.6 Fixed in 1.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4294 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 91200df1978f Credits Bartlomiej Marek and...

WordPress WP VK Plugin < 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP VK Type Plugin Vulnerable versions 1.3.4 Fixed in 1.3.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 35c374f0a596 Credits WordFence Required privilege Unauthenticat...

WordPress Premmerce User Roles Plugin <= 1.0.12 is vulnerable to Broken Access Control

Software Premmerce User Roles Type Plugin Vulnerable versions = 1.0.12 Fixed in 1.0.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41130 Patch priority High CVSS severity High 8.1 Developer Premmerce PSID 8954c8b59cab Credits Nguyen Xuan Chien Required...

CVE-2023-40176 SXSS in the user profile via the timezone displayer

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop...

WordPress Push Notification for Post and BuddyPress Plugin < 1.64 is vulnerable to Broken Access Control

Software Push Notification for Post and BuddyPress Type Plugin Vulnerable versions 1.64 Fixed in 1.64 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d085fa7b4246 Credits Unknown Required...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. In the function zzipdiskentrytofileheader located in the mmapped.c file. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users...

WordPress JupiterX Core Plugin <= 3.3.8 is vulnerable to Privilege Escalation

Software JupiterX Core Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.4.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-38389 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID bb67776164d1 Credits Rafie...

WordPress Paid Memberships Pro CCBill Gateway Plugin <= 0.3 is vulnerable to Broken Access Control

Software Paid Memberships Pro CCBill Gateway Type Plugin Vulnerable versions = 0.3 Fixed in 0.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40608 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 6824186fd879 Credits Rafie Muhamma...

WordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Typing Effect Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40605 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 92bc3bb12d2e Credits yuyudhn Required privileg...

WordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open Redirection

Software Doofinder for WooCommerce Type Plugin Vulnerable versions = 1.5.49 Fixed in 2.0.0 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2023-40602 Patch priority Low CVSS severity Low 4.7 Developer Doofinder PSID 9706ea3eb29b Credits minhtuanact Required privilege...

WordPress Timeline and History slider Plugin <= 2.1 is vulnerable to Broken Access Control

Software Timeline and History slider Type Plugin Vulnerable versions = 2.1 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a3a9df023238 Credits Abdi Pranata Requir...

WordPress Post Ticker Ultimate Plugin <= 1.5.5 is vulnerable to Broken Access Control

Software Post Ticker Ultimate Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 25c80b813ad7 Credits Abdi Pranata Required...

WordPress Blog Designer - Post and Widget Plugin <= 2.5.1 is vulnerable to Broken Access Control

Software Blog Designer - Post and Widget Type Plugin Vulnerable versions = 2.5.1 Fixed in 2.5.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 364b0ab37c11 Credits Abdi Pranata...

WordPress Advanced File Manager Plugin < 5.1.1 is vulnerable to Sensitive Data Exposure

Software Advanced File Manager Type Plugin Vulnerable versions 5.1.1 Fixed in 5.1.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-3814 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID c11d3f659c9c Credits Dmitrii Required...

WordPress Portfolio and Projects Plugin <= 1.3.7 is vulnerable to Broken Access Control

Software Portfolio and Projects Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4fd5786d3c57 Credits Abdi Pranata Required...

WordPress InfiniteWP Client Plugin <= 1.11.1 is vulnerable to Sensitive Data Exposure

Software InfiniteWP Client Type Plugin Vulnerable versions = 1.11.1 Fixed in 1.12.1 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-2916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 88e39a11f14f Credits Lana Codes Required...

WordPress User Submitted Posts Plugin <= 20230809 is vulnerable to Cross Site Scripting (XSS)

Software User Submitted Posts Type Plugin Vulnerable versions = 20230809 Fixed in 20230811 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4308 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7067f0962238 Credits NGÔ THI...