Code injection

Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Medium...

Design/Logic Flaw

Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. Chromium security severity: Medium...

Design/Logic Flaw

Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-5856

Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-5855

Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. Chromium security severity: Medium...

CVE-2023-5853

CVE-2023-5853: A security-UI obfuscation vulnerability in Chromium-based browsers (Chrome/Chromium) before 119.0.6045.105; a crafted HTML page could mislead users in the Downloads UI. Remediation: upgrade to 119.0.6045.105 or newer.

CVE-2023-5852

Summary of CVE-2023-5852 : A use-after-free in the Printing component of Google Chrome/Chromium prior to version 119.0.6045.105 could allow a remote attacker to trigger heap corruption by convincing a user to perform specific UI gestures. Impact is high (CVE-2023-5852 is associated with high base...

CVE-2023-5851

Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-5850

Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Medium...

CVE-2023-5851

Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

WordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce – Store Exporter Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46822 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e0dcf0ba69c0 Credits Muhammad Daffa...

WordPress Ads by datafeedr.com Plugin <= 1.1.3 is vulnerable to Remote Code Execution (RCE)

Software Ads by datafeedr.com Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.2.0 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-5843 Patch priority Medium CVSS severity Medium 9 Developer Claim ownership PSID 4d60ddac47c0 Credits István Márton Required...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Plugin <= 2.24.14 is vulnerable to Settings Change

Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Type Plugin Vulnerable versions = 2.24.14 Fixed in 2.24.18 OWASP Top 10 A3: Injection Classification Settings Change CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 75375faf9c46...

WordPress PHP to Page Plugin <= 0.3 is vulnerable to Remote Code Execution (RCE)

Software PHP to Page Type Plugin Vulnerable versions = 0.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-5199 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID fd52cb970119 Credits István Márton Required privilege...

WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5426 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID a003d34ca1b2 Credits Francesco Carlucc...

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46635 Patch priority Medium CVSS severity Medium 5.3 Developer YITH PSID e6f126f82710 Credits Elliot Required...

Advisory ROSA-SA-2023-2260

software: upx 4.0.2 OS: ROSA-CHROME packageevrstring: upx-4.0.2-1.src.rpm CVE-ID: CVE-2019-20805 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: plxelf.cpp in UPX before version 3.96 has an integer overflow during unpacking via created values in the PTDYNAMIC segment. CVE-STATUS: Fixed CVE-REV: To close...

WordPress EventON Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software EventON Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-4635 Patch priority Medium CVSS severity Medium 6.1 Developer Claim ownership PSID 2a9d3b757474 Credits Shuning Xu Required privilege...

WordPress Grid Plus Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Grid Plus Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46209 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 08eeb73facf3 Credits Le Ngoc Anh Required...

WordPress Booking Calendar Plugin <= 9.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Type Plugin Vulnerable versions = 9.7.3 Fixed in 9.7.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4620 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1f5ad35a7a1 Credits Pablo Sanchez...