Advisory ROSA-SA-2023-2275

software: irssi 1.4.2 OS: ROSA-CHROME packageevrstring: irssi-1.4.2-2.src.rpm CVE-ID: CVE-2023-29132 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Irssi 1.3.x and 1.4.x before 1.4.4 has post-release usage due to the use of an obsolete special builder reference. This occurs when printing an unformatted...

Advisory ROSA-SA-2023-2264

software: libtiff 4.1.0 OS: ROSA-CHROME packageevrstring: libtiff-4.1.0-4.src.rpm CVE-ID: CVE-2022-2868 BDU-ID: 2023-00296 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the tiffcrop utility exists due to insufficient input validation. Exploitation of the vulnerability could allow an attacker to...

Advisory ROSA-SA-2023-2260

software: upx 4.0.2 OS: ROSA-CHROME packageevrstring: upx-4.0.2-1.src.rpm CVE-ID: CVE-2019-20805 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: plxelf.cpp in UPX before version 3.96 has an integer overflow during unpacking via created values in the PTDYNAMIC segment. CVE-STATUS: Fixed CVE-REV: To close...

WordPress EventON Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software EventON Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-4635 Patch priority Medium CVSS severity Medium 6.1 Developer Claim ownership PSID 2a9d3b757474 Credits Shuning Xu Required privilege...

openSUSE 15 Security Update : bluetuith (openSUSE-SU-2023:0307-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0307-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

WordPress Grid Plus Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Grid Plus Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46209 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 08eeb73facf3 Credits Le Ngoc Anh Required...

WordPress Taggbox Plugin <= 3.3 is vulnerable to Broken Access Control

Software Taggbox Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33215 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 74a01c79e50d Credits Jonas Höbenreich Required privilege...

WordPress Social proof testimonials and reviews by Repuso Plugin <= 4.97 is vulnerable to Broken Access Control

Software Social proof testimonials and reviews by Repuso Type Plugin Vulnerable versions = 4.97 Fixed in 5.00 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46196 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b9598b02b70d...

WordPress Archivist – Custom Archive Templates Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Software Archivist – Custom Archive Templates Type Plugin Vulnerable versions = 1.7.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46194 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 9eaf34517c88 Credit...

WordPress Templately Plugin < 2.2.6 is vulnerable to Broken Access Control

Software Templately Type Plugin Vulnerable versions 2.2.6 Fixed in 2.2.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5454 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d43e1c889b21 Credits Krzysztof Zając CERT PL Require...

WordPress MpOperationLogs Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software MpOperationLogs Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5538 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 58b2eea0d790 Credits juweihuitao Required...

Advisory ROSA-SA-2023-2245

Software: bind 9.11.26 OS: ROSA Virtualization 2.1 packageevrstring: bind-9.11.26-6.rv3.src.rpm CVE-ID: CVE-2019-6470 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: There was a bug in a function in one of the ISC BIND libraries that dhcpd used when running in DHCPv6 mode. There was also a bug in dhcpd's...

WordPress PageLayer Plugin < 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Software PageLayer Type Plugin Vulnerable versions 1.7.7 Fixed in 1.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4687 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2e6d35b385c Credits Marc Montpas Required...

WordPress Social Media & Share Icons Plugin <= 2.8.5 is vulnerable to Sensitive Data Exposure

Software Social Media & Share Icons Type Plugin Vulnerable versions = 2.8.5 Fixed in 2.8.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-5070 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 041c1c8cf3d2 Credits Marco...

WordPress WP Matterport Shortcode Plugin < 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Matterport Shortcode Type Plugin Vulnerable versions 2.1.7 Fixed in 2.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4290 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7f614e386ab6 Credits Erwan LR...

WordPress Tutor LMS Plugin < 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Tutor LMS Type Plugin Vulnerable versions 2.3.0 Fixed in 2.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4805 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 74daed2fad19 Credits emad-fazel Required...

WordPress Booking Calendar Plugin <= 9.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Type Plugin Vulnerable versions = 9.7.3 Fixed in 9.7.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4620 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1f5ad35a7a1 Credits Pablo Sanchez...

WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Software Spider Facebook Type Plugin Vulnerable versions = 1.0.15 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46090 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 44993b9d3d08 Credits LEE SE HYOUNG...

WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder, Contact Widget Type Plugin Vulnerable versions = 2.1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46075 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4c2d6ac7f320 Credit...

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

Software Lava Directory Manager Type Plugin Vulnerable versions = 1.1.34 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46081 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f0161d7b2655 Credits Emili...