WordPress Eventin Plugin <= 3.3.52 is vulnerable to Broken Access Control

Software Eventin Type Plugin Vulnerable versions = 3.3.52 Fixed in 3.3.53 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-49756 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID fd0f59f34c59 Credits Abdi Pranata Required privile...

WordPress Widgets for Ebay Reviews Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Ebay Reviews Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID f3398dead03e Credits Rafie Muhammad Patchstack...

WordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Simply Exclude Type Plugin Vulnerable versions = 2.0.6.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48743 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 391a661fbc93 Credits Le Ngoc Anh Required privilege...

samba security update

4.18.6-2.0.1 - resolves: RHEL-11937 Fix CVE-2023-3961 - smbd must check the pipename - resolves: RHEL-11937 Fix CVE-2023-4091 - SMB clients can truncate files - resolves: RHEL-11937 Fix CVE-2023-42669 - Remove rpcecho server...

PT-2023-8865 · Unknown +1 · Minizip-Ng +1

Name of the Vulnerable Software and Affected Versions: minizip-ng version 4.0.2 Description: The issue is related to a Buffer Overflow in the mz path resolve function, located in the mz os.c file, which can be exploited by an attacker using a crafted file. This could allow a remote attacker to...

WordPress Userpro Plugin <= 5.1.4 is vulnerable to Privilege Escalation

Software Userpro Type Plugin Vulnerable versions = 5.1.4 Fixed in 5.1.5 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2023-6009 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 7046ef9feaa8 Credits István Márton Required privilege...

WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Upload

Software CataBlog Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-47842 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID ca3ef4e541ae Credits Rafie Muhammad Patchstack Required privilege...

WordPress EmbedPress Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)

Software EmbedPress Type Plugin Vulnerable versions = 3.9.1 Fixed in 3.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 60378c6bfade Credits WordFence Required privilege...

curl security update

7.76.1-26.el93.2 - fix cookie injection with none file CVE-2023-38546 7.76.1-26.el93.1 - socks: return error if hostname too long for remote resolve CVE-2023-38545...

WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Interactive World Map Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47767 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 246d6d2a2061 Credits Le Ngoc Anh...

WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Bus Ticket Booking with Seat Reservation Type Plugin Vulnerable versions = 5.2.5 Fixed in 5.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30496 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID cc34a3da3177...

WordPress WP Custom Admin Interface Plugin <= 7.31 is vulnerable to Broken Access Control

Software WP Custom Admin Interface Type Plugin Vulnerable versions = 7.31 Fixed in 7.32 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47763 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 73d0182de151 Credits Abdi Pranata...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Broken Access Control

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46146 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID dba7a9d87836 Credits Rafie Muhammad Patchstack...

Information Disclosure

org.wildfly.core: wildfly-controller is vulnerable to Information Disclosure. The vulnerability is caused by a missing authorization check in the resolve-expression HAL interface while reading a system property or environment variables. This can lead to a malicious user accessing the Wildfly syst...

WordPress Flo Forms Plugin <= 1.0.41 is vulnerable to Broken Access Control

Software Flo Forms Type Plugin Vulnerable versions = 1.0.41 Fixed in 1.0.42 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47692 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 415778b368e8 Credits Abdi Pranata Required...

WordPress WP Responsive Recent Post Slider/Carousel Plugin <= 3.4 is vulnerable to Broken Access Control

Software WP Responsive Recent Post Slider/Carousel Type Plugin Vulnerable versions = 3.4 Fixed in 3.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 9480041e2654 Credits...

CVE-2023-4061

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system...

WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

Software Restrict Content Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-47668 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 1e46aa10dc26 Credits...

PT-2023-27539 · Unknown · Wildfly-Core

Name of the Vulnerable Software and Affected Versions: Wildfly-core affected versions not specified Description: A flaw in wildfly-core allows a management user to use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This could enable a...

WordPress EazyDocs Plugin <= 2.3.5 is vulnerable to Broken Access Control

Software EazyDocs Type Plugin Vulnerable versions = 2.3.5 Fixed in 2.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47648 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 25f152946ed4 Credits Skalucy Required privilege...