CVE-2023-32310 DataEase API interface has IDOR vulnerability

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references IDOR. This could result in a user deleting another user's dashboard or messages or interfering with the...

Vulnerability fixed in Arista series 7000 switches

Arista has fixed a vulnerability in the EOS software of several Series 7000 switches. A malicious party can exploit abuse the vulnerability to use a manipulated DHCP packet to crash and restart the DHCP relay service to crash and restart, thus creating a partial Denial-of-Service can occur. Arist...

CVE-2023-33183 Error in calendar when booking an appointment reveals the full path of the website

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3...

JVN#95981715: Starlette vulnerable to directory traversal

Starlette provided by Encode contains a directory traversal vulnerability CWE-22. Impact Under certain conditions, a remote attacker may view files in a web service which was built using the product. Solution Update the software Update the software according to the information provided by the...

PT-2023-19798 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2023.04 Description: The issue affects the network stack of RIOT-OS, specifically in the processing of 6LoWPAN frames. An attacker can send a crafted frame, resulting in an integer underflow and out of bounds access ...

PT-2023-19887 · Unknown · 984.Ru For The Visually Impaired Plugin

Name of the Vulnerable Software and Affected Versions: 984.Ru For the visually impaired plugin versions = 0.58 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on ...

PT-2023-24104 · WordPress · Better Notifications For Wp

Name of the Vulnerable Software and Affected Versions: Made with Fuel Better Notifications for WP plugin versions 1.9.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-15181 · WordPress · Ninja Tables

Name of the Vulnerable Software and Affected Versions: Ninja Tables – Best Data Table Plugin for WordPress versions prior to 4.3.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-15184 · WordPress · Wp Basic Elements

Name of the Vulnerable Software and Affected Versions: WP Basic Elements plugin versions prior to 5.2.15 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-14055 · Learningtimes · Badgeos

Name of the Vulnerable Software and Affected Versions: LearningTimes BadgeOS plugin versions = 3.7.1.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web applicatio...

SUSE-SU-2023:2287-1 Security update for cups-filters, poppler, texlive

This update for cups-filters, poppler, texlive fixes the following issues: cups-filters: - CVE-2023-24805: Fixed a remote code execution in the beh backend bsc1211340. texlive: - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX bsc1211389. poppler: - Added missing header file...

PT-2023-15322 · WordPress · Viadat Creations Store Locator For Wordpress With Google Maps – Lotsoflocales

Name of the Vulnerable Software and Affected Versions: Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin versions = 3.98.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintend...

PT-2023-14652 · WordPress · Glen Don L. Mongaya Drag/Drop Multiple File Upload – Contact Form 7

Name of the Vulnerable Software and Affected Versions: Glen Don L. Mongaya Drag and Drop Multiple File Upload – Contact Form 7 plugin versions = 1.3.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a...

PT-2023-17518

Name of the Vulnerable Software and Affected Versions Armoli Technology Cargo Tracking System versions before 3558f28 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, allowing authentication abuse and bypass. This vulnerability enables potenti...

PT-2023-20092 · Unknown · Csaba Kissi About Me 3000 Widget Plugin

Name of the Vulnerable Software and Affected Versions: Csaba Kissi About Me 3000 widget plugin versions = 2.2.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-21701 · Unknown · Snow Monkey Forms

Name of the Vulnerable Software and Affected Versions: Snow Monkey Forms versions v5.0.6 and earlier Description: A directory traversal vulnerability allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service DoS condition...

Tornado vulnerable to open redirect

Overview Tornado provided by tornadoweb contains a vulnerability that triggers open redirect CWE-601 under certain non-default configurations. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2023-19124 · Bob Goetz · Wp-Topbar

Name of the Vulnerable Software and Affected Versions: Bob Goetz WP-TopBar plugin versions = 5.36 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

JVN#45127776: Tornado vulnerable to open redirect

Tornado provided by tornadoweb contains a vulnerability that triggers open redirect CWE-601 under certain non-default configurations. Impact When accessing a specially crafted URL, the user of the website using the affected product may be redirected to an arbitrary website. As a result, the user...

PT-2023-15434 · WordPress · Cs&M Hover Image Plugin

Name of the Vulnerable Software and Affected Versions: Julian Weinert // cs&m Hover Image plugin versions 1.4.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintende...