WordPress WPGetAPI Plugin 2.1.0-2.2.1 is vulnerable to Broken Access Control

Software WPGetAPI Type Plugin Vulnerable versions 2.1.0-2.2.1 Fixed in 2.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID ca2d9e4727c6 Credits Unknown Required privilege Subscriber...

WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure

Software WP Ultimate Exporter Type Plugin Vulnerable versions = 2.4.1 Fixed in 2.4.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-2487 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID b22ef0e23a4e Credits Jonas Höbenreic...

WordPress Copy Or Move Comments Plugin <= 5.0.4 is vulnerable to SQL Injection

Software Copy Or Move Comments Type Plugin Vulnerable versions = 5.0.4 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28748 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c441c723b0a4 Credits minhtuanact Required privilege Subscriber...

WordPress WooODT Lite Plugin <= 2.4.7 is vulnerable to Cross Site Scripting (XSS)

Software WooODT Lite Type Plugin Vulnerable versions = 2.4.7 Fixed in 2.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45006 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4ca8f692a25b Credits Le Ngoc Anh Required...

WordPress MStore API Plugin <= 4.0.6 is vulnerable to SQL Injection

Software MStore API Type Plugin Vulnerable versions = 4.0.6 Fixed in 4.0.7 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-45055 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 62679b9fbc47 Credits Truoc Phan Required privilege Subscriber Published 3...

Last stakers may not receive funds back

Lines of code Vulnerability details Impact Last stakers may not receive funds back. Proof of Concept When user wants to withdraw, then he needs to initiate requestWithdraw. As some part of funds are locked as cvx token inside vlcvx that means that they should be withdrawn. When you lock cvx then...

WordPress Simple Membership Plugin <= 4.3.4 is vulnerable to Privilege Escalation

Software Simple Membership Type Plugin Vulnerable versions = 4.3.4 Fixed in 4.3.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-41957 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 1bb17eda4daa Credits Rafie...

WordPress wpDiscuz Plugin < 7.6.6 is vulnerable to SQL Injection

Software wpDiscuz Type Plugin Vulnerable versions 7.6.6 Fixed in 7.6.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID fcbd1df4be98 Credits Unknown Required privilege Unauthenticated Published 19 September,...

Insider Threat Awareness Month: Protecting Your Business from Within

By Waqas This article delves into the significance of Insider Threat Awareness Month and explores effective strategies that organizations can employ to detect and mitigate these often elusive threats. This is a post from HackRead.com Read the original post: Insider Threat Awareness Month:...

MAL-2023-8140 Malicious code in hardhat-gas-tracer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca926144035df7a8d332e6904ed879e15a43427f301b5b1849c40e2b82dfda07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerability CVE-2008-5161 (SSH Server CBC Mode Ciphers Enabled) on SDX

Regarding vulnerability CVE-2008-5161 SSH Server CBC Mode Ciphers Enabled, we need to follow the below article to mitigate this vulnerability. Addressing False Positives from CBC and MAC Vulnerability Scans of NetScaler SSHD citrix.com However, we are unable to perform the steps mentioned in the...

Wrong calculation of elapsed days

Lines of code Vulnerability details Impact For a certain period of time, the dailyIr is compounded every day. However, when calculating prevClosePrice, the last day's addition is missed. The formula for calculating the current price is as follows: Range.dailyInterestRate Days Elapsed + 1...

WordPress Form Maker by 10Web Plugin < 1.15.20 is vulnerable to Arbitrary File Upload

Software Form Maker by 10Web Type Plugin Vulnerable versions 1.15.20 Fixed in 1.15.20 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE N/A Patch priority High CVSS severity High 10 Developer Claim ownership PSID 385edba53528 Credits N/A Required privilege Unauthenticated...

WordPress Travel Map Plugin < 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Travel Map Type Plugin Vulnerable versions 1.0.1 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41860 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 4ba841714848 Credits Mika Required privilege...

WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software PeproDev CF7 Database Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41863 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9fea5340d869 Credits RE-ALTER Required privileg...

WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)

Software RSVPMarker Type Plugin Vulnerable versions = 10.6.6 Fixed in 10.6.7 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-25054 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 8f0ff34720aa Credits Ravi Dharmawan Required privilege...

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.0 Fixed in 2.6.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-34383 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 02d3661940eb Credits Theodoros Malachias Required privilege...

WordPress Surfer Plugin <= 1.3.2.357 is vulnerable to Broken Access Control

Software Surfer Type Plugin Vulnerable versions = 1.3.2.357 Fixed in 1.3.3.379 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35037 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID fee59b89530e Credits Jonas Höbenreich Required...

WordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)

Software WP Bannerize Pro Type Plugin Vulnerable versions = 1.6.9 Fixed in 1.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41663 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 77839e376c07 Credits thiennv Required...

WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Sermon'e – Sermons Online Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41653 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7d587500f95f Credits yuyudhn...