CVE-2023-45066

Summary: CVE-2023-45066 affects the WordPress plugin “Smackcoders Export All Posts, Products, Orders, Refunds & Users.” Technical details across connected sources show an information disclosure vulnerability where sensitive data may be exposed to unauthorized actors via exposed export data. Affec...

CVE-2023-46820

The CVE-2023-46820 entry concerns the WordPress plugin Image Regenerate & Select Crop. Affected versions are

CVE-2023-48333

CVE-2023-48333 affects Booster for WooCommerce (WordPress plugin by Pluggabl LLC) up to version 7.1.1, where an unauthorized actor with subscriber-level access could exfiltrate order information due to a missing capability check (init_atts). CVSS v3.1 base score 6.5 (Medium) with Confidentiality ...

CVE-2023-48365

creationtimestamp| type| source ---|---|--- 2023-11-30 08:45:23+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus28/2023 2023-11-30 17:55:24+00:00| seen| https://t.me/truesecator/5149 2023-12-03 17:01:28+00:00| seen| https://t.me/redfoxsec/24 2023-12-22 11:44:34+00:00| seen|...

Security Bulletin: Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI - October 2023 CPU

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about security vulnerabilities affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2023-40626

CVE-2023-40626 concerns Joomla! information disclosure via the language file parsing process, which can be manipulated to expose environment variables. The vulnerability affects Joomla! instances that self-report as vulnerable versions (e.g., Joomla! 5.x prior to 5.0.1 and 1.6.x prior to 4.4.1) p...

CVE-2023-29060

CVE-2023-29060 describes a USB access control weakness in the BD FACSChorus workstation OS where the system does not restrict which USB devices can interact with ports. Affected products: BD FACSChorus on v5.0, v5.1, v3.0, and v3.1 workstations. Root cause: missing protection mechanism for altern...

CVE-2023-40056

SolarWinds Orion Platform is affected by a SQL Injection Remote Code Execution vulnerability (CVE-2023-40056). The known flaw exists in the VimChartInfo class and arises from improper validation of a user-supplied string used to construct SQL queries, enabling remote code execution. Exploitation ...

CVE-2023-42505

CVE-2023-42505 affects Apache Superset prior to 3.0.0. An authenticated user with read permissions on database connections metadata could access sensitive information such as the connection username. The connected documents confirm the affected product and impact but do not provide exploit detail...

OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Detailed Checkout totals information may be received by Checkout ID...

CVE-2023-43754

Mattermost contains a vulnerability where permalink previews do not verify the setting that controls viewing archived channels. The root cause is a missing check during permalink preview generation, allowing members to see previews for archived channels even when the setting to view archived chan...

A Comprehensive CTEM Guide for CISOs

In this video, Anand Choudha, CEO at Hive Pro, and Jeelan Poola, CPO at Hive Pro, introduce the HivePro Uni5 Threat Exposure Management Platform. HivePro Uni...

N. Korean Hackers Distribute Trojanized CyberLink Software in Supply Chain Attack

A North Korean state-sponsored threat actor tracked as Diamond Sleet is distributing a trojanized version of a legitimate application developed by a Taiwanese multimedia software developer called CyberLink to target downstream customers via a supply chain attack. "This malicious file is a...

CVE-2023-47668

The CVE concerns the StellarWP Membership Plugin – Restrict Content, affecting versions ≤ 3.2.7. The root cause is exposure of sensitive information to an unauthorised actor via the plugin’s legacy log mechanism (noted as legacy rcp-debug.log exposure). Practical impact is unauthenticated access ...

CVE-2023-40002

CVE-2023-40002 concerns the Booster for WooCommerce WordPress plugin. Affected: Booster for WooCommerce plugin versions

CVE-2023-47821

CVE-2023-47821 affects the WordPress Email Encoder Bundle plugin (

CVE-2021-22143

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers...

OpenHarmony has an unspecified vulnerability (CNVD-2023-91563)

OpenHarmony is a kind of hongmeng operating system open source project. A security vulnerability exists in OpenHarmony before version v3.2.2, which can be exploited by attackers to cause system information leakage...

CVE-2023-47014

CVE-2023-47014 affects Sourcecodester Sticky Notes App Using PHP with Source Code v1.0. It is a CSRF vulnerability in add-note.php that can let a local attacker obtain sensitive information. NVD lists CVSS v3.1 base score 6.5 (MEDIUM) with network attack vector, low complexity, no privileges, use...

Design/Logic Flaw

IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770...