WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.20 Fixed in 6.21 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-51696 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Backup Migration Plugin <= 1.3.9 is vulnerable to Path Traversal

Software Backup Migration Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6972 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 63ca4651f92b Credits NP3228 Required privilege...

WordPress Backup Migration Plugin 1.0.8-1.3.9 is vulnerable to Remote File Inclusion

Software Backup Migration Type Plugin Vulnerable versions 1.0.8-1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Remote File Inclusion CVE CVE-2023-6971 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e70590c9be58 Credits NP3228 - NFlabs...

CVE-2023-50928 sandbox-accounts-for-events security misconfiguration leads to budget exceed

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...

WordPress Bit File Manager Plugin < 6.3 is vulnerable to Path Traversal

Software Bit File Manager Type Plugin Vulnerable versions 6.3 Fixed in 6.3 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-5907 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID f6d18601e62a Credits Dmitrii Ignatyev Required privilege...

Security Misconfiguration

dockerspawner is vulnerable to Security Misconfiguration. The vulnerability is due to overly permissible pull container image configuration. An attacker can launch any pullable image as a result of this vulnerability...

WordPress Welcart e-Commerce Plugin <= 2.9.6 is vulnerable to Path Traversal

Software Welcart e-Commerce Type Plugin Vulnerable versions = 2.9.6 Fixed in 2.9.7 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6120 Patch priority Medium CVSS severity Medium 4.1 Developer Claim ownership PSID 545792f26683 Credits Marco Wotschka Required...

WordPress Coming soon and Maintenance mode Plugin <= 3.7.3 is vulnerable to Bypass Vulnerability

Software Coming soon and Maintenance mode Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.7.4 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-49741 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID d62ae4e054de Credits Mika...

WordPress Backup Migration Plugin <= 1.3.6 is vulnerable to Sensitive Data Exposure

Software Backup Migration Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-6266 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7df0ea44f3d7 Credits Rafshanzani Suhada...

WordPress Restricted Site Access Plugin <= 7.4.1 is vulnerable to Bypass Vulnerability

Software Restricted Site Access Type Plugin Vulnerable versions = 7.4.1 Fixed in 7.5.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48753 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4346ee127b88 Credits Mika Required...

WordPress Captcha Code Plugin <= 2.9 is vulnerable to Bypass Vulnerability

Software Captcha Code Type Plugin Vulnerable versions = 2.9 Fixed in 3.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48745 Patch priority Low CVSS severity Low 5.3 Developer WebFactory Ltd. PSID c2ae3ab19d4d Credits qilin99 Required privilege...

WordPress Contact Form Email Plugin <= 1.3.41 is vulnerable to Bypass Vulnerability

Software Contact Form Email Type Plugin Vulnerable versions = 1.3.41 Fixed in 1.3.42 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48318 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f3190218dd33 Credits qilin99 Required...

WordPress Form Maker by 10Web Plugin <= 1.15.20 is vulnerable to Bypass Vulnerability

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.20 Fixed in 1.15.21 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48290 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 419f98d34635 Credits qilin99 Required...

WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection

Software Integration for Contact Form 7 and Constant Contact Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-47779 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 64bf5916b57c...

WordPress WP Google My Business Auto Publish Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Google My Business Auto Publish Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-47237 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 19fe6caa3a0c Credits...

WordPress Awesome Support Plugin < 6.1.5 is vulnerable to Arbitrary File Deletion

Software Awesome Support Type Plugin Vulnerable versions 6.1.5 Fixed in 6.1.5 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2023-5355 Patch priority Medium CVSS severity Medium 7.7 Developer Claim ownership PSID b2eca27b2e54 Credits Alex Sanford Require...

WordPress YOP Poll Plugin <= 6.5.28 is vulnerable to Broken Authentication

Software YOP Poll Type Plugin Vulnerable versions = 6.5.28 Fixed in 6.5.29 OWASP Top 10 A5: Security Misconfiguration Classification Broken Authentication CVE CVE-2023-46611 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f8c5b7c225ab Credits qilin99 Required privilege...

2023 OWASP Top-10 Series: Wrap Up

Over the past several months, we've taken a journey through the new 2023 OWASP API Security Top-10 list. In the previous 12 weekly posts, we've delved into each category, discussed what it is, how it's exploited, why it matters, and suggested effective protections for each. Now, as we conclude th...

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection

Software Responsive Column Widgets Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-45762 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 59d95f8609d5 Credits Phd Required privilege...

The vulnerability of the Safari browser on the macOS operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Safari browser on the macOS operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, acting remotely, to gain unauthorized access to protected information...