WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)

Software NextGen GalleryView Type Plugin Vulnerable versions = 0.5.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35098 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8e241746a1e2 Credits LEE SE HYOUNG...

WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35093 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fe9a14774ad1 Credits Rafshanzani Suhada...

trafficserver:FuzzHTTP: Use-of-uninitialized-value in DFA::build

Project: https://github.com/apache/trafficserver.git Detailed Report: https://oss-fuzz.com/testcase?key=5739350995107840 Project: trafficserver Fuzzing Engine: libFuzzer Fuzz Target: FuzzHTTP Job Type: libfuzzermsantrafficserver Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)

Software Church Admin Type Plugin Vulnerable versions = 3.7.29 Fixed in 3.7.30 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34021 Patch priority Medium CVSS severity Medium 7.1 Developer Andy Moyle PSID 57d5d23230bd Credits Phd Required privilege...

libdwarf:fuzz_die_cu_attrs_loclist: Heap-buffer-overflow in read_encoded_addr

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=4504718844755968 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzdiecuattrsloclist Job Type: aflasanlibdwarf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ntopng:fuzz_dissect_packet: Heap-buffer-overflow in NetworkInterface::dissectPacket

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=4557557394702336 Project: ntopng Fuzzing Engine: afl Fuzz Target: fuzzdissectpacket Job Type: aflasanntopng Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x607000001105 Crash...

notary:FuzzVerify: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6222953076097024 Project: notary Fuzzing Engine: libFuzzer Fuzz Target: FuzzVerify Job Type: libfuzzerasannotary Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000000b7be Crash State: NULL Sanitizer: address ASAN Recommended...

WordPress Getwid – Gutenberg Blocks Plugin <= 1.8.3 is vulnerable to Broken Access Control

Software Getwid – Gutenberg Blocks Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1910 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID bae53bb70dd5 Credits Ramuel Gall...

poppler:pdf_draw_fuzzer: Heap-buffer-overflow in cairo_cff_parse_charstring

Detailed Report: https://oss-fuzz.com/testcase?key=4950740863680512 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: pdfdrawfuzzer Job Type: libfuzzerasanpoppler Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x63000001e920 Crash State: cairocffparsecharstring...

WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder by vcita Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2300 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3b4b71b799e4 Credits Jonas...

lldpd:fuzz_lldp: Use-of-uninitialized-value in lldp_decode

Project: https://github.com/lldpd/lldpd.git Detailed Report: https://oss-fuzz.com/testcase?key=5193822305648640 Project: lldpd Fuzzing Engine: libFuzzer Fuzz Target: fuzzlldp Job Type: libfuzzermsanlldpd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

binutils:fuzz_as: Heap-use-after-free in hash_symbol_entry

Detailed Report: https://oss-fuzz.com/testcase?key=6268463220654080 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzas Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x62100002c414 Crash State: hashsymbolentry htabfindslot...

CVE-2023-2938

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Information disclosure

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Design/Logic Flaw

Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-2939

Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. Chromium security severity: Medium...

CVE-2023-2940

Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-2939

Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. Chromium security severity: Medium...

CVE-2023-2937

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-2937

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...