Moderate: Red Hat Security Advisory: container-tools:4.0 security and bug fix update

An update for the container-tools:4.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

RHEL 9 : toolbox (RHSA-2023:6346)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6346 advisory. Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman...

Important: Red Hat Security Advisory: Logging Subsystem 5.6.12 - Red Hat OpenShift security update

Logging Subsystem 5.6.12 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2023-2453

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

Design/Logic Flaw

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

CVE-2023-2453

CVE-2023-2453 affects PHPFusion. The issue is insufficient sanitization of tainted file names directly concatenated with a path and passed to a require_once statement, allowing inclusion and execution of arbitrary .php files when the absolute path is known. The description notes there is no known...

CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

SUSE-SU-2023:3002-1 Security update for go1.20-openssl

This update for go1.20-openssl fixes the following issues: Update to version 1.20.6.1 bsc1206346: - CVE-2023-29406: Fixed insufficient sanitization of Host header bsc1213229...

CVE-2023-2433

The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...

Cross site scripting

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmcpostreception action. This makes it possible for authenticated attacker...

CVE-2023-2082 Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmcpostreception action. This makes it possible for authenticated attacker...

PT-2023-23410 · WordPress · Email Queue

Name of the Vulnerable Software and Affected Versions: Mail Queue plugin for WordPress versions up to, and including, 1.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing Stored Cross-Site Scripting attacks. This enables unauthenticated attackers to...

PT-2023-22989 · WordPress · Wp Mail Logging

Name of the Vulnerable Software and Affected Versions: WP Mail Logging plugin for WordPress versions up to and including 1.11.1 Description: The issue is related to Stored Cross-Site Scripting via email contents due to insufficient input sanitization and output escaping. This allows unauthenticat...

CVE-2023-29406 Insufficient sanitization of Host header in net/http

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Active Directory Integration / LDAP Integration < 4.1.6 - Sensitive Information Disclosure

The plugin will expose Sensitive Information due to insufficient sanitization of the supplied username value...

VulnCheck KEV: CVE-2021-4358

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2023-12489 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with minimal permissions to inject arbitra...

WordPress 5.4.x < 5.4.13 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...