AcyMailing Joomla Component 访问控制错误漏洞

AcyMailing Joomla Component is an email marketing component used in the Joomla content management system. An Access Control Error vulnerability exists in AcyMailing Joomla Component, which stems from the presence of incorrect access control that allows unauthorized users to create new mailing lis...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 31, 2023 to August 6, 2023)

Last week, there were 29 vulnerabilities disclosed in 24 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 18 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

WEBinsta Mailing Manager 1.3 Information Disclosure

==================================================================================================================================== | Title : WEBinsta Mailing Manager V1.3 Data Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

GHSA-G9W4-PRF3-M25G Obfuscated email addresses should not be sorted

Impact The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps. Patches This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1. Workarounds The workaround is t...

Obfuscated email addresses should not be sorted

Impact The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps. Patches This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1. Workarounds The workaround is t...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 10, 2023 to July 16, 2023)

Note: We accidentally sent out an email for this report with last weeks subject line. Due to the subject line not being very different week to week for this report, we opted to just leave it as is and not send a follow-up email. We apologize for this error on our part! Last week, there were 69...

The vulnerability of the Discourse mailing list management software lies in the insufficient verification of input data, allowing attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of the Discourse mailing list management software is related to insufficient validation of input data during the processing of topic headers. Exploitation of this vulnerability could allow a malicious actor to compromise the integrity and accessibility of the protected informati...

[SECURITY] [DSA 5455-1] iperf3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5455-1 [email protected] https://www.debian.org/security/ Aron Xu July 17, 2023 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 5450-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5450-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 07, 2023 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5447-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5447-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2023 https://www.debian.org/security/faq -...

XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alertdocument.domain This vulnerability exists sin...

[SECURITY] [DSA 5434-1] minidlna security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5434-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 21, 2023 https://www.debian.org/security/faq -...

GHSA-RF8J-Q39G-7XFM XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults

Impact Any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. Patches The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. Workarounds The vulnerability can be fixed by applying this patch. ...

GHSA-7VR7-CGHH-CH63 XWiki Platform may retrieve email addresses of all users

Impact The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated: - the rest response was also containing the mail unobfuscated - user were able to filter and sort on the unobfuscated allowing to infer the mail content The...

XWiki Platform may retrieve email addresses of all users

Impact The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated: - the rest response was also containing the mail unobfuscated - user were able to filter and sort on the unobfuscated allowing to infer the mail content The...

XWiki Platform's tags on non-viewable pages can be revealed to users

Impact Tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. Patches This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1. Workarounds There is no workaround...

GHSA-G75C-CJR6-39MC XWiki Platform's Mail.MailConfig can be edited by any user with edit rights

Impact Mail.MailConfig can be edited by any logged-in user by default. Consequently, they can: - change the mail obfuscation configuration - view and edit the mail sending configuration, including the smtp domain name and credentials. Patches The problem has been patched on XWiki 14.4.8, 15.1, an...

GHSA-R7WR-4W5Q-55M6 Cilium vulnerable to information leakage via incorrect ReferenceGrant handling

Impact When the Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium gaining visibility of secrets including certificates and services across namespaces. An attacker on an affected cluster can configure Cilium to use...

Fedora: Security Advisory for sympa (FEDORA-2023-419ca55dd3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...