Information disclosure

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wiki...

Wiz launches support for Google Cloud excessive access findings based on audit logs

Google Cloud customers can now detect excessive access in their GCP environment based on Google audit logs to effectively right-size permissions...

The Bin Laden Letter Is Being Weaponized by the Far Right

Far-right influencers and right-wing lawmakers are using the spread of Osama bin Laden’s “Letter to America” to call for a TikTok ban and boost decades old conspiracies...

VulnCheck KEV: CVE-2022-34121

Cuppa CMS v1.0 was discovered to contain a local file inclusion LFI vulnerability via the component /templates/default/html/windows/right.php...

XWiki Platform privilege escalation from script right to programming right through title displayer

Impact In XWiki Platform, it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. To reproduce: As a user with script but not programming right, create a document with the following content: velocity set$main =...

CVE-2023-4154

A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers RODCs. This flaw allows RODCs and users possessing the GETCHANGES right to access all attributes, including sensitive...

CVE-2023-5431

CVE-2023-5431 affects the Left right image slideshow gallery WordPress plugin. The flaw is an SQL Injection via the plugin shortcode in versions

WordPress Plugin Left right image slideshow gallery SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-32100 · WordPress · Left Right Image Slideshow Gallery Plugin

Name of the Vulnerable Software and Affected Versions: Left right image slideshow gallery plugin for WordPress versions up to, and including, 12.0 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

WordPress Left right image slideshow gallery Plugin <= 12.0 is vulnerable to SQL Injection

Software Left right image slideshow gallery Type Plugin Vulnerable versions = 12.0 Fixed in 12.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5431 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a8ec43c6fd5b Credits István Márton Required privilege...

CVE-2023-45135 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In org.xwiki.platform:xwiki-platform-web versions 7.2-milestone-2 until 14.10.12 and org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12 and 15.5-rc-1, it is possible to...

CVE-2023-30154

Multiple improper neutralization of SQL parameters in module AfterMail aftermailpresta for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via idcustomer, idconf, idproduct and token parameters in aftermailajax.php via the 'idproduct' parameter in hooks...

The right-click does not work on the start menu of Windows 11.

Right-click does not work on the start menu of Windows 11. This issue only occurs when VDA is installed. Uninstall VDA or VDA not installed environments do not cause this issue...

Design/Logic Flaw

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...

CVE-2023-43663 Improper Privilege Management in Prestashop

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...

The vulnerability of the `grow_right_pane_tree()` function in the Cacti network monitoring software, which allows a hacker to execute arbitrary SQL queries.

The vulnerability of the growrightpanetree function in the Cacti network monitoring software’s script graphview.php relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using a specially...

PYSEC-2023-167

Vyper is a Pythonic Smart Contract Language. For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. unsafeadd, unsafesub, unsafemul, unsafediv, powmod256, |, &, ^ bitwise operators, bitwiseor deprecated,...

CVE-2023-36678

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin = 3.5.5 versions...

CVE-2023-36678

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin = 3.5.5 versions...

CVE-2023-36678

CVE-2023-36678 affects the WordPress plugin WP Content Copy Protection & No Right Click up to version 3.5.5. It is an authenticated Stored XSS vulnerability (admin+ required) through the plugin, with low impact to confidentiality/integrity and no impact to availability per the cited sources. A fi...