Medium: postgresql92

Issue Overview: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and...

CVE-2023-0473

Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-0473

Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

WordPress GPT3 AI Content Writer Plugin < 1.4.38 is vulnerable to Content Injection

Software GPT3 AI Content Writer Type Plugin Vulnerable versions 1.4.38 Fixed in 1.4.38 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-0405 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 868b79c31d14 Credits Lana Codes Required privilege...

WordPress GPT3 AI Content Writer Plugin < 1.4.38 is vulnerable to Broken Access Control

Software GPT3 AI Content Writer Type Plugin Vulnerable versions 1.4.38 Fixed in 1.4.38 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0405 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID b166ac0894d6 Credits István Márton...

WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)

Software M Chart Type Plugin Vulnerable versions = 1.9.4 Fixed in 1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23892 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 383eb1775479 Credits thiennv Required privilege...

USN-5573-1: rsync vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Evgeny Legerov discovered that zlib incorrectly handled memory when performing certain inflate operations. An attacker could use this issue to cause rsync to crash, resulting in a...

USN-5748-1: Sysstat vulnerability | Cloud Foundry

usn-5748-1 Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that Sysstat incorrectly handled certain arithmetic multiplications. An attacker could use this issue to cause Sysstat to crash, resulting in a denial o...

WordPress Lightbox Photo Gallery Plugin < 0.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Lightbox Photo Gallery Type Plugin Vulnerable versions 0.9.5 Fixed in 0.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4682 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 26f255866ba8 Credits Lana Codes...

WordPress MainWP Boilerplate Extension Plugin <= 4.1 is vulnerable to Broken Access Control

Software MainWP Boilerplate Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23745 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID bc472be7aa50 Credits Dave Jong...

WordPress Widgets on Pages Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Widgets on Pages Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.8.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4488 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 86b237a22e6a Credits Lana Codes Requir...

WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to Settings Change

Software MainWP Maintenance Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23662 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 8194a64eddf2 Credits Dave Jong...

WordPress WP FullCalendar Plugin <= 1.4.1 is vulnerable to Broken Access Control

Software WP FullCalendar Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-3891 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID ab1743664bc8 Credits Lana Codes Required...

security/tor -- SOCKS4(a) inversion bug

The Tor Project reports: TROVE-2022-002: The SafeSocks option for SOCKS4a is inverted leading to SOCKS4 going through This is a report from hackerone: We have classified this as medium considering that tor was not defending in-depth for dangerous SOCKS request and so any user relying on SafeSocks...

WordPress Flexible Captcha Plugin <= 4.1 is vulnerable to Cross Site Scripting (XSS)

Software Flexible Captcha Type Plugin Vulnerable versions = 4.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0147 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 303d2e17f357 Credits István Márton Require...

WordPress Gallery Factory Lite Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Gallery Factory Lite Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0148 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 88f855435d38 Credits István Márton...

CVE-2023-0135

Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. Chromium security severity: Medium...

CVE-2023-0131

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-0131

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

Design/Logic Flaw

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...