Improper Neutralization of Special Elements Used in a Template Engine

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine due to the improper neutralization of special elements used in a template...

Missing Support for Integrity Check

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Missing Support for Integrity Check due to improper handling of authorization checks. An attacker can bypass security features and access restricted...

XML Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can bypass security features by sending a specially crafted XML script. Remediation...

Incorrect Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks. A low-privileged attacker can modify minor functionalities of another user's data...

Improper Input Validation

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Input Validation through the input validation process. An attacker with administrative privileges can bypass certain security features,...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to remote sensitive information exposure due to IBM GSKit (CVE-2023-32342)

Summary There is a vulnerability in IBM GSKit used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain...

WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Recipe Maker For Your Food Blog from Zip Recipes Type Plugin Vulnerable versions = 8.0.7 Fixed in 8.0.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35089 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Contact Form by WD Plugin <= 1.15.16 is vulnerable to Broken Access Control

Software Contact Form by WD Type Plugin Vulnerable versions = 1.15.16 Fixed in 1.15.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1b7f926114eb Credits Unknown Required privilege...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. A vulnerability exists in NuGet where a race condition can lead to a symlink attack. Note: Non-Linux platforms are not affected. Remediation There is no fixed version for Microsoft.Build.NuGetSdkResolver...

WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.93 Fixed in 3.3.94 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-34373 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 598837ada134 Credits...

WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)

Software Church Admin Type Plugin Vulnerable versions = 3.7.29 Fixed in 3.7.30 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34021 Patch priority Medium CVSS severity Medium 7.1 Developer Andy Moyle PSID 57d5d23230bd Credits Phd Required privilege...

WordPress Fat Rat Collect Plugin <= 2.6.7 is vulnerable to Broken Access Control

Software Fat Rat Collect Type Plugin Vulnerable versions = 2.6.7 Fixed in 2.6.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35045 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3675b324429a Credits Abdi Pranata Required privile...

WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Booking and Rental Manager Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35048 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 73d697a7ce84 Credits NeginNrb...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.3.1 is vulnerable to Sensitive Data Exposure

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-0692 Patch priority Medium CVSS severity Medium 4.3 Developer Wpmet PSID d33b9b89cda5 Credits Ramuel...

WordPress FiboSearch – Ajax Search for WooCommerce Plugin <= 1.23.0 is vulnerable to Cross Site Scripting (XSS)

Software FiboSearch – Ajax Search for WooCommerce Type Plugin Vulnerable versions = 1.23.0 Fixed in 1.24.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2450 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1e16f85faf8c Credi...

CVE-2023-2280

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...

PT-2023-17317 · WordPress · Directorist

Name of the Vulnerable Software and Affected Versions: Directorist plugin for WordPress versions up to, and including, 7.5.4 Description: The issue arises from improper validation and authorization checks within the listing task function, allowing authenticated attackers with subscriber-level...

Thruk Monitoring Web Interface 3.06 - Path Traversal

Exploit Title: Thruk Monitoring Web Interface 3.06 - Path Traversal Date: 08-Jun-2023 Exploit Author: Galoget Latorre @galoget CVE: CVE-2023-34096 Galoget Latorre Vendor Homepage: https://thruk.org/ Software Link: https://github.com/sni/Thruk/archive/refs/tags/v3.06.zip Software Link + Exploit +...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the yajltreeparse function. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other vulnerabilities, DoS attacks...

WordPress Directorist Plugin <= 7.5.4 is vulnerable to Privilege Escalation

Software Directorist Type Plugin Vulnerable versions = 7.5.4 Fixed in 7.5.5 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-1888 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 3e2d4eebdb38 Credits Alex Thomas Required privilege...