CVE-2023-7004

CVE-2023-7004 affects the TTLock ecosystem (TTLock App and related Sciener firmware) with a root cause of insufficient verification to prove device identity, enabling a device that spoofs a lock’s MAC address to connect and compromise the unlockKey, affecting lock integrity. Reported by multiple ...

CVE-2023-7009

CVE-2023-7009 affects Sciener-based locks where plaintext BLE messages are processed as encrypted communications. The issue allows unencrypted commands (less than 16 bytes) to be treated as valid encrypted traffic, potentially compromising lock integrity. Connected sources identify affected compo...

CVE-2023-7017

CVE-2023-7017 affects Sciener locks with BLE-based firmware updates. The vulnerability is that the firmware update mechanism does not authenticate or validate updates delivered via Bluetooth Low Energy, enabling a challenge request to be sent to the lock to prepare for an update (instead of an un...

CVE-2024-2497

RaspAP raspap-webgui 3.0.9 contains a code injection vulnerability in includes/provider.php via the HTTP POST parameter country, enabling remote code execution. Exploitation is possible over the network and public disclosures exist. A remediation is available: upgrade to billz/raspap-webgui 3.1.0...

CVE-2023-46181

CVE-2023-46181 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0. The issue allows web pages to be stored locally and read by another user on the same system (information disclosure). Remediation: upgrade to IBM Sterling Secure Proxy iFix 11 (for 6.0.3) or iFix 03 (for 6.1.0) per IBM. Ot...

CVE-2023-47699

CVE-2023-47699 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0. A cross-site scripting vulnerability in the Web UI could let an attacker embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. The NVD/IBM entries list a base score of 6.1 (Medi...

CVE-2023-47147

IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0 are affected by a vulnerability that could allow an attacker to overwrite a log message under specific conditions. The issue is addressed by upgrading to iFix 11 for 6.0.3 and iFix 03 for 6.1.0. Remediation details are provided in IBM’s advisorie...

CVE-2023-46179

IBM Sterling Secure Proxy is affected on versions 6.0.3 and 6.1.0 by a vulnerability where authorization tokens or session cookies lack the secure attribute. The issue lets an attacker potentially obtain cookie values by tricking a user into visiting a http link or via a site the user visits, ena...

CVE-2023-51522

CVE-2023-51522 is a CSRF vulnerability in the Cozmoslabs Paid Member Subscriptions WordPress plugin, affecting version 2.10.4 and earlier. Evidence from NVD confirms a CSRF issue impacting Paid Member Subscriptions, and PT Security notes that for versions 2.10.4 and earlier the fix is to update t...

CVE-2023-51369

CVE-2023-51369 describes a Cross-Site Request Forgery (CSRF) vulnerability in WordPress plugin SysBasics Customize My Account for WooCommerce, affecting versions n/a through 1.8.3. Public sources (RH and CN/ENISA references) confirm the issue is CSRF, with remediation guidance recommending upgrad...

CVE-2023-50861

CVE-2023-50861 concerns the WordPress plugin HUSKY – Products Filter for WooCommerce (formerly WOOF). The vulnerability is a Cross-Site Request Forgery (CSRF) affecting the plugin versions from n/a up to and including 1.3.4.3 . The CVE entry cites a high impact with CVSS v3.1 vector: AV:N/AC:L/PR...

CVE-2024-25597

CVE-2024-25597 affects WordPress plugin Ultimate Reviews (Etoile Web Design) up to version 3.2.8. The issue is unauthorized, stored XSS triggered via the reviews feature due to improper input handling during page generation. The vulnerability is addressed in version 3.2.9 (patched). No exploitati...

CVE-2024-25598

CVE-2024-25598 is a Stored XSS vulnerability in Livemesh Addons for Elementor (versions n/a–8.3). The issue stems from improper input handling leading to scripts being injected via the animated_text_class/related inputs and executed when pages load. Exploitation requires at least Contributor-leve...

CVE-2024-2495

CVE-2024-2495 affects FriendlyWrt firmware (example version: 2022-11-16.51b3d35). The connected documents describe a plaintext cryptographic key vulnerability in the firmware, exposing the key material and enabling an attacker to compromise the confidentiality and integrity of encrypted data. The...

CVE-2024-25916

CVE-2024-25916 affects the WordPress My Calendar plugin up to version 3.4.23. The root cause is improper neutralization of input during page generation, resulting in Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerabili...

CVE-2024-25934

CVE-2024-25934 : WordPress FormFacade plugin (versions

CVE-2024-27189

CVE-2024-27189 affects WordPress WP Social Widget (plugin) versions up to and including 2.2.5, with a Stored XSS due to improper input neutralization during page generation. Public reports confirm the issue (WordPress plugin page and Red Hat/NVD references) and indicate a fix was released in vers...

CVE-2024-27193

CVE-2024-27193 is a Reflected XSS in the PayU India WordPress plugin (affected: PayU India Official Plugin ≤ 3.8.2) due to improper input neutralization during web page generation. The issue concerns the type parameter being reflected in the response, enabling an attacker to inject scripts when a...

CVE-2024-27196

CVE-2024-27196 affects the WordPress plugin postMash – custom post order (versions up to and including 1.2.0). Public docs describe a Reflected XSS vulnerability in that plugin. Core details in connected sources specify affected product/version and the nature of the vulnerability (Reflected XSS);...

CVE-2023-6725

CVE-2023-6725 affects Red Hat OpenStack Platform 17.1 components tripleo-ansible and openstack-tripleo-heat-templates, with a root cause of bind keys being world readable. This could expose private configuration data (e.g., BIND keys) to an attacker with access to the host/container. Remediation ...