Design/Logic Flaw

Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-49244

Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-49244

CVE-2023-49244 concerns a permission management vulnerability in the multi-user module of Huawei HarmonyOS. The vulnerability is described as affecting service confidentiality due to improper permission handling in the multi-user module. The primary, documented impact is confidentiality loss; no ...

WordPress Multi Currency For WooCommerce Plugin <= 1.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Currency For WooCommerce Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49840 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c36e478dcad3 Credits Nguy...

PT-2023-31131 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service...

CVE-2023-5970

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass...

SonicWALL SSL-VPN SMA100 series Security Vulnerability

The SonicWALL SSL-VPN SMA100 series is SonicWALL's for secure remote connectivity. A series of VPN connectivity solutions. A security vulnerability exists in the SonicWALL SSL-VPN SMA100 series that stems from incorrect authentication and allows a remote attacker to create the same external domai...

Multi-session support for Desktop OS in Citrix environment

Multi-session support for Desktop OS in Citrix Environment...

Huawei HarmonyOS Security Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a privilege management vulnerability in the multi-user module. Successful exploitation ...

PT-2023-32452 · Sonicwall · Sma100 Ssl-Vpn

Name of the Vulnerable Software and Affected Versions: SMA100 SSL-VPN virtual office portal affected versions not specified Description: The issue is related to improper authentication in the SMA100 SSL-VPN virtual office portal. This allows a remote authenticated attacker to create an identical...

Geo Controller < 8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Geo Controller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 8.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-5990

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks...

23andMe says, er, actually some genetic and health data might have been accessed in recent breach

In October we reported that the data of as many as seven million 23andMe customers were for sale on criminal forums following a password attack against the genomics company. Now, a filing with the US Securities and Exchange Commission SEC has provided some more insight into the data theft. The...

WordPress plugin Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. The WordPress plugin Interactive Contact Fo...

PT-2023-28431 · Samsung · Libfacepreprocessingjni.Camera.Samsung.So

Name of the Vulnerable Software and Affected Versions: libFacePreProcessingjni.camera.samsung.so versions prior to SMR Dec-2023 Release 1 Description: The issue is related to an integer overflow vulnerability in the detectionFindFaceSupportMultiInstance function of the...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

SoundCloud Shortcode < 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The SoundCloud Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Simple Long Form <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Simple Long Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

Use After Free

xorg-server is vulnerable to Use After Free. The vulnerability is caused when using X server in Zaphod mode a multi-screen setup with multiple protocol screens when the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is...

CVE-2023-38400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4...