WordPress Easy Registration Forms Plugin <= 2.1.1 is vulnerable to Sensitive Data Exposure

Software Easy Registration Forms Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-5134 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a5bfe7a3054b Credits Lana Codes Required...

CVE-2023-38888

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject...

Ubuntu: Security Advisory (USN-6387-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-28710 · Netis · Netis 360Rac1200

Name of the Vulnerable Software and Affected Versions: Netis 360RAC1200 version 1.3.4517 Description: The issue allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management. Recommendations: For...

CVE-2023-42399

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component...

WordPress Booster for WooCommerce Plugin <= 7.1.0 is vulnerable to Sensitive Data Exposure

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.1.0 Fixed in 7.1.1 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-4796 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d3120f1c06fe Credits Lana Codes...

CVE-2023-4917

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

WordPress Leyka Plugin <= 3.30.7 is vulnerable to Sensitive Data Exposure

Software Leyka Type Plugin Vulnerable versions = 3.30.7 Fixed in 3.30.7.1 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-4917 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a132ae587b9f Credits Lana Codes Required privilege...

How to Prevent API Breaches: A Guide to Robust Security

With the growing reliance on web applications and digital platforms, the use of application programming interfaces APIs has become increasingly popular. If you aren't familiar with the term, APIs allow applications to communicate with each other and they play a vital role in modern software...

Sensitive Data Exposure

nilsteampassnet/teampass is vulnerable to Sensitive Data Exposure. The vulnerability is due to not restricting/limiting directory listing for various end points. The leads to disclosing application-specific user data and files...

CVE-2023-30717

Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.3, which stems from an application that may be able to read sensitive location information...

WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data Exposure

Software Email posts to subscribers Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-41735 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 57fcad585177 Credits Rafshanzani Suhada...

PT-2023-22920 · Unknown · Inboundsmshandler

Name of the Vulnerable Software and Affected Versions: InboundSmsHandler versions prior to SMR Sep-2023 Release 1 Description: The issue allows local attackers to access certain message data due to an Exposure of Sensitive Information vulnerability in InboundSmsHandler. This vulnerability enables...

SQL injection and Authentication bypass

Description The validApiKey middleware, which is responsible for verifying API keys provided in the request's Authorization header, is susceptible to SQL injection. This vulnerability can potentially lead to an authentication bypass, granting unauthorized access to API endpoints. NOTE: It's worth...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.3.1 is vulnerable to Sensitive Data Exposure

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-0689 Patch priority Low CVSS severity Low 4.3 Developer Wpmet PSID 4be7cb75c51f Credits Ramuel Gall...

PT-2023-23311 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.0 Brocade SANnav version 2.2.2a Description: The issue is related to possible information exposure through a log file vulnerability. Sensitive fields are recorded in the configuration log without masking. ...

The vulnerability of TP-Link Tapo L530 Wi-Fi light controller software lies in the lack of protection for sensitive data, allowing intruders to obtain confidential information.

The vulnerability of the Wi-Fi lamp controller software from TP-Link, the Tapo L530, lies in the lack of protection for sensitive data. Exploiting this vulnerability could allow a remote attacker to obtain confidential information through the TSKEP authentication function...

PT-2023-27656 · Pf4J +1 · Pf4J +1

Name of the Vulnerable Software and Affected Versions: pf4j versions 3.9.0 and earlier Description: An issue in pf4j allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter. Recommendations: For pf4j versions 3.9.0 and earlier, consider...