17607 matches found
CVE-2023-47516
CVE-2023-47516 is a CSRF vulnerability in the WordPress plugin “Category Post List Widget” that allows Stored XSS in versions
WordPress Plugin WDSocialWidgets Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Symfony potential Cross-site Scripting in WebhookController
Description The error message in WebhookController returns unescaped user-submitted input. Resolution WebhookController now doesn't return any user-submitted input in its response. The patch for this issue is available here for branch 6.3. Credits We would like to thank Maxime Aknin for reporting...
CVE-2023-5959
Summary: CVE-2023-5959 affects Byzoro Smart S85F Management Platform v31R02B10-01. The vulnerability is in an unknown function of /login.php where manipulating the txt_newpwd parameter leads to weak password recovery. Public disclosure is noted. The issue is described as a technical weakness rath...
In _executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values.
Lines of code Vulnerability details M5 - In executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values. poc: solidity function executeSetSignatureValidator internal returns bytes memory nextProgressData requiredata.signatureHash != bytes320, "Signatu...
CVE-2023-5542
CVE-2023-5542 corresponds to an improper access control issue in Moodle: students in an "Only see own membership" group could view other students in the same group. This is corroborated by OSV and GHSA entries (BIT-MOODLE-2023-5542, GHSA-8MM2-M2GP-C6X2) describing the same behavior. Public refere...
Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center
CVE-2023-22518 Exploit Description This repository contain...
CVE-2023-47366
CVE-2023-47366 affects the Line app’s Craft Members module, specifically version 13.6.1. The root cause is the leakage of a channel access token in craft_members Line 13.6.1, which could allow a remote attacker to send malicious notifications to victims. The available connected sources confirm th...
CVE-2023-46483
CVE-2023-46483 describes a Cross Site Scripting (XSS) vulnerability in Timetec AWDMS v2.0, exploitable via the remark parameter of the New Zone function. Affected: timetec AWDMS 2.0; root cause is unvalidated input in the remark field leading to information disclosure. CVSS v3.1 base score 5.4 (A...
PT-2023-12977 · Undefined · Undefined
Fletch Top Threat Alert: CVE-2023-29552: CISA Warns of Actively Exploited SLP Vulnerability - CVE-2023-29552 FletchScore = High/Mainstream CyberSecurity ThreatIntel InfoSec CVE-2023-29552 CVE-2022-29552 CVE-2021-21974 ESXiArgs https://t.co/8WOC7N9kT1...
CVE-2023-6001
Prometheus metrics are accessible without authentication in YugabyteDB Anywhere (CVE-2023-6001). Affected component is Prometheus metrics exposure within YugabyteDB Anywhere, leading to potential exposure of sensitive environment information. Documented impact includes high confidentiality impact...
CVE-2023-46744
CVE-2023-46744 concerns a stored XSS in Squidex via SVG asset uploads. The vulnerability arises because the SVG filtering logic (which blocks [removed] and on* attributes) can be bypassed by using elements like with a javascript: URL, allowing an authenticated attacker (with assets.create permis...
CVE-2022-44738
CVE-2022-44738 relates to the WordPress Posts and Users Stats plugin (
CVE-2023-28563
CVE-2023-28563 affects IOE Firmware in Qualcomm chipsets. The root cause is information disclosure when processing WMI commands in the firmware, leading to potentially exposed data (confidentiality impact high). The issue is listed in Android Pixel bulletin as a closed‑source component vulnerabil...
CVE-2023-46501
BoltWire CMS v6.03 is affected by an vulnerability described across multiple sources as an improper access control issue that enables a remote attacker to obtain sensitive information by crafting payloads to the view and change admin password function. The issue is consistently tied to BoltWire v...
[SECURITY] Fedora 39 Update: wordpress-6.3.2-1.fc39
Wordpress is an online publishing / weblog package that makes it very easy, almost trivial, to get information out to people on the web. Important information in /usr/share/doc/wordpress/README.fedora...
CVE-2023-34179
CVE-2023-34179 : Groundhogg WordPress plugin (≤ 2.7.11) is vulnerable to SQL Injection due to improper neutralization of input. Impact per sources includes potential unauthorized data access with high impact; exploitation details are not provided in the documents. Patch recommended: upgrade to 2....
CVE-2023-46980
CVE-2023-46980 vulnerability affects Best Courier Management System v1.0. A remote attacker can execute arbitrary code and escalate privileges via a crafted script to the userID parameter. The core issue is a likely insecure handling of the userID input allowing code execution with high impact (c...