WordPress If Menu Plugin <= 0.16.3 is vulnerable to Broken Access Control

Software If Menu Type Plugin Vulnerable versions = 0.16.3 Fixed in 0.17.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-41698 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6fd87b73bf2d Credits Nguyen Anh Tien Required...

SUSE SLES15 Security Update : oracleasm (SUSE-SU-2023:0853-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0853-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE...

WordPress GamiPress – Youtube integration Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Youtube integration Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1fad36729cfa Credits Unknown...

Silicon Labs Wi-SUN Linux Border Router 安全漏洞

Silicon Labs Wi-SUN Linux Border Router is a border router from Silicon Labs. A security vulnerability exists in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier versions, which stems from a problem with the MAC layer security of the software. An attacker could use this vulnerability to...

WordPress Branded Social Images Plugin <= 1.1.0 is vulnerable to Broken Access Control

Software Branded Social Images Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-28536 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID d288421a23b1 Credits Yuki Haruma...

SUSE SLES15 Security Update : drbd (SUSE-SU-2023:0800-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:0800-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE security...

SUSE SLES12 Security Update : oracleasm (SUSE-SU-2023:0797-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:0797-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE security...

WordPress WP Job Portal Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Job Portal Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28534 Patch priority Medium CVSS severity Medium 6.5 Developer Ahmad PSID e68a92571619 Credits Fariq Fadillah Gusti Insani...

Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 6, 2023 to Mar 12, 2023)

Last week, there were 60 vulnerabilities disclosed in 40 WordPress Plugins and 1 WordPress theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 16 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in...

WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)

Software Slide Anything Type Plugin Vulnerable versions = 2.4.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28499 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 20dca4f988b8 Credits RE-ALTER Required...

WordPress Weaver Xtreme Theme Support Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Weaver Xtreme Theme Support Type Plugin Vulnerable versions = 5.0.2 Fixed in 6.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7fef1f764ecf Credits Unknown Required...

WordPress Backup Bank: WordPress Backup Plugin Plugin <= 4.0.28 is vulnerable to Broken Access Control

Software Backup Bank: WordPress Backup Plugin Type Plugin Vulnerable versions = 4.0.28 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-28165 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1712eef4d84c Credits...

WordPress Chankhe Theme <= 1.0.5 is vulnerable to Broken Authentication

Software Chankhe Type Theme Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-28416 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 9050e7df6a1b Credits Dave Jong Patchstack Required...

Advisory ROSA-SA-2023-2132

Software: pesign 0.109 OS: rosa-server79 packageevrstring: pesign-0.109-11 CVE-ID: CVE-2022-3560 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC: A flaw has been found in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to set ACLs...

Grafana -- Stored XSS in Graphite FunctionDescription tooltip

Grafana Labs reports: When a user adds a Graphite data source, they can then use the data source in a dashboard. This capability contains a feature to use Functions. Once a function is selected, a small tooltip appears when hovering over the name of the function. This tooltip allows you to delete...

WordPress Woo Products Widgets For Elementor Plugin < 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Woo Products Widgets For Elementor Type Plugin Vulnerable versions 1.0.8 Fixed in 1.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4661 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1f3087ed1109 Credits...

WordPress Ajax Load More Plugin < 5.6.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Load More Type Plugin Vulnerable versions 5.6.0.3 Fixed in 5.6.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4466 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 33d2d66c78ff Credits Lana Codes Requir...

WordPress Exxp Plugin <= 2.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Exxp Type Plugin Vulnerable versions = 2.6.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-45812 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3cd5dbca9c91 Credits Aman Rawat Required privilege...

WordPress RapidLoad Power-Up for Autoptimize Plugin <= 1.7.1 is vulnerable to Broken Access Control

Software RapidLoad Power-Up for Autoptimize Type Plugin Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1339 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 443f715a7f8d Credits Marco...

WordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Brilliance Type Theme Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28171 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 3d9a1effb3cc Credits Dave Jong Patchstack...