PT-2023-27963

Name of the Vulnerable Software and Affected Versions BAN Users plugin for WordPress versions up to, and including, 1.5.3 Description The issue is related to a missing capability check on the w3dev save ban user settings callback function, which allows authenticated attackers with minimal...

Cacti host_new_graphs_save Code Execution

The vulnerability of the hostnewgraphssave function in the Cacti network monitoring software’s script graphsnew.php involves the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using specially...

CVE-2023-35676

In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2023-25261 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an unsafe PendingIntent in the createQuickShareAction of SaveImageInBackgroundTask.java. This could lead to a background activit...

OESA-2023-1612 poppler security update

Poppler is a free software utility library for rendering Portable Document Format PDF documents. \ Its development is supported by freedesktop.org. It is commonly used on Linux systems,and is used by \ the PDF viewers of the open source GNOME and KDE desktop environments. Security Fixes:...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android due to an insecure PendingIntent in the createQuickShareAction of SaveImageInBackgroundTask.java, which can be exploited by an attacker to elevate privileges...

FreeBSD : FreeBSD -- Wi-Fi encryption bypass (924cb116-4d35-11ee-8e38-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 924cb116-4d35-11ee-8e38-002590c1f29c advisory. - The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept...

UBUNTU-CVE-2023-39357

Cacti is an open source operational monitoring and fault management framework. A defect in the sqlsave function was discovered. When the column type is numeric, the sqlsave function directly utilizes user input. Many files and functions calling the sqlsave function do not perform prior validation...

PT-2023-4943

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.25 Description The issue is a Stored Cross-Site-Scripting XSS vulnerability that allows an authenticated user to poison data. It is found in the graphs new.php file. Several validations are performed, but the return...

Cacti Cross-Site Scripting Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. Cacti suffers from a cross-site scripting vulnerability that stems from the...

PT-2023-5424

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.25 Description A defect in the sql save function was discovered in Cacti, an open source operational monitoring and fault management framework. When the column type is numeric, the sql save function directly utilize...

PT-2023-4942

Name of the Vulnerable Software and Affected Versions Cacti versions 1.2.24 Description The issue is related to insecure deserialization in Cacti, specifically within the host new graphs save function in graphs new.php. This is due to the use of the unserialize function without sanitizing user...

CVE-2023-40980

File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file...

CVE-2023-3636

The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'saveusersmapname' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modif...

CVE-2023-4161

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

CVE-2023-3764

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoice...

Cross site request forgery (csrf)

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoice...

CVE-2023-4161 WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

WordPress plugin WooCommerce PDF Invoice Builder has a cross-site request forgeing vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

CVE-2023-3764: Cross-Site Request Forgery (CSRF)

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoice...