WordPress Qubely – Advanced Gutenberg Blocks Plugin <= 1.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Qubely – Advanced Gutenberg Blocks Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0376 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1329c46c6231 Credits...

CVE-2023-0699

Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. Chromium security severity: Medium...

CVE-2023-0702

Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-0699

CVE-2023-0699 is a use-after-free vulnerability in the GPU component of Google Chrome/Chromium prior to 110.0.5481.77. A remote attacker could exploit heap corruption via a crafted HTML page and browser shutdown. Several connected sources confirm the issue and its remediation path, including Chro...

WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Vietnam Checkout Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-46843 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2c2374a1822 Credits Team...

CVE-2023-0700

Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

MultiRewardEscrow.claimRewards() can break for rebasing tokens

Lines of code Vulnerability details Rebasing tokens make balanceOf modifications arbitrarily e.g: Aave share tokens. If such token is used in an escrow, the balance could become insufficient at the time of claiming rewards, making it impossible to claim rewards for that escrow. Impact Medium Proo...

CVE-2023-0699

Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. Chromium security severity: Medium...

CVE-2023-0700

Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

WordPress Booking Calendar Contact Form Plugin <= 1.2.34 is vulnerable to Broken Access Control

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.34 Fixed in 1.2.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25037 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1c56c1a6fa83 Credits István...

WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure

Software Ajax Search Lite Type Plugin Vulnerable versions = 4.10.3 Fixed in 4.11 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-38456 Patch priority Medium CVSS severity Medium 4.3 Developer WPdreams PSID 59c3957625b5 Credits István Márton Required...

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Broken Access Control

Software Quick Contact Form Type Plugin Vulnerable versions = 8.0.3.1 Fixed in 8.0.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25035 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4879b77b9e44 Credits yuyudhn Required...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.8.3 is vulnerable to Broken Access Control

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.8.3 Fixed in 2.2.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45803 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4cd389bac6...

WordPress Monolit Theme Theme <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Monolit Theme Type Theme Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25041 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 37e734d552d0 Credits RE-ALTER Required...

Upgraded Q -> 3 from #154 [1675567996775]

Judge has assessed an item in Issue 154 as 3 risk. The relevant finding follows: Erc20Quest.withdrawFee can be called against a quest more than once function withdrawFee public onlyAdminWithdrawAfterEnd IERC20rewardToken.safeTransferprotocolFeeRecipient, protocolFee; The withdrawFee function does...

WordPress Cost Calculator Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9f3fe5b616f3 Credits Marco Wotschka Required privileg...

WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Image Gallery, Gallery Album Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47603 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 679ee9055f30...

WordPress Image Hover Effects - Caption Hover with Carousel Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Image Hover Effects - Caption Hover with Carousel Type Plugin Vulnerable versions = 2.8 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-45831 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Magazine Edge Theme <= 1.13 is vulnerable to Broken Authentication

Software Magazine Edge Type Theme Vulnerable versions = 1.13 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-25068 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 9064016ee308 Credits Dave Jong Patchstack Required...

K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...