PT-2023-31910

Name of the Vulnerable Software and Affected Versions Add Custom Body Class plugin for WordPress versions up to, and including, 1.4.1 Description The issue is related to Stored Cross-Site Scripting via the add custom body class value due to insufficient input sanitization and output escaping. Thi...

CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordereandata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordereandata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

CVE-2023-5071: Improper Neutralization of Input During Web Page Generation

The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekitiframe' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...

PT-2023-31616

Name of the Vulnerable Software and Affected Versions Sitekit plugin for WordPress versions up to, and including, 1.4 Description The issue is related to Stored Cross-Site Scripting via the sitekit iframe shortcode due to insufficient input sanitization and output escaping. This allows...

PT-2023-32220

Name of the Vulnerable Software and Affected Versions The Thumbnail Slider With Lightbox plugin for WordPress version 1.0 Description The issue is related to Stored Cross-Site Scripting via the Image Title field due to insufficient input sanitization and output escaping. This allows authenticated...

Warning: Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild

Cisco has warned of a critical, unpatched security flaw impacting IOS XE software that's under active exploitation in the wild. Rooted in the web UI feature, the zero-day vulnerability is tracked as CVE-2023-20198 and has been assigned the maximum severity rating of 10.0 on the CVSS scoring syste...

CVE-2023-31096

An issue was discovered in Broadcom LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 aka AGRSM64.sys. There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory IOCTL 0x1b2150. An attacker can exploit this to elevate privileges from a medium-integrity process to...

CVE-2023-4401

Dell SmartFabric Storage Software v1.4 and earlier contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access...

Command injection

Dell SmartFabric Storage Software v1.4 and earlier contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access...

CVE-2023-4401

Dell SmartFabric Storage Software (Dell) vulnerability CVE-2023-4401: OS command injection in the CLI using the more command affects v1.4 and earlier, enabling root-level access for authenticated users (local/remote). Root cause: command injection via CLI command parsing. Impact: potential full s...

CVE-2023-4401

Dell SmartFabric Storage Software v1.4 and earlier contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access...

CVE-2023-4401: Improper Neutralization of Special Elements used in a Command

Dell SmartFabric Storage Software v1.4 and earlier contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access...

WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update

Description The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action. This makes it possible for authenticated attackers with contributor-level access and above, to update C...

CVE-2023-4948

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

Design/Logic Flaw

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

PT-2023-28279

Name of the Vulnerable Software and Affected Versions Simplr Registration Form Plus+ plugin for WordPress versions up to, and including, 2.4.5 Description The issue is related to Insecure Direct Object References, which allows user-controlled access to objects. This enables authenticated attacker...

SolarWinds Serv-U 15.4 < 15.4 HF2 Authentication Bypass

The version of SolarWinds Serv-U installed on the remote host is prior to 15.4 HF2. It is, therefore, affected by a vulnerability as referenced in the serv-u154hf2 advisory. - A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass...

CVE-2023-40060

A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds found that the issue was not completely...

Authentication flaw

A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds found that the issue was not completely...