Fedora: Security Advisory for netconsd (FEDORA-2023-6b4d3ca766)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for chromium (FEDORA-2023-7f87c8b975)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

F5 Networks BIG-IP : tcpdump vulnerability (K56551263)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.3.1 / 15.1.3 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K56551263 advisory. The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-...

solution-vertrieb.de Improper Access Control vulnerability OBB-3771432

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Huawei EulerOS: Security Advisory for procps-ng (EulerOS-SA-2023-3106)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2023-3101)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic...

WordPress The Plus Addons for Elementor Pro Plugin <= 5.2.8 is vulnerable to Local File Inclusion

Software The Plus Addons for Elementor Pro Type Plugin Vulnerable versions = 5.2.8 Fixed in 5.2.9 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-47178 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 0501be93705b Credits Rafie Muhammad...

Huawei EulerOS: Security Advisory for zstd (EulerOS-SA-2023-3046)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-46139

KernelSU (Android) prior to 0.7.0 is affected. The root cause is a mismatch in signature verification logic: the vulnerable path reads the last signing block with id 0x7109871a, while Android installation validates the first block, allowing a malware-signed block to bypass verification and escala...

WordPress Jquery news ticker Plugin <= 3.0 is vulnerable to SQL Injection

Software Jquery news ticker Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5430 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID f8ae8a455966 Credits István Márton Required privilege Contributor...

WordPress Weather Atlas Widget Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Weather Atlas Widget Type Plugin Vulnerable versions = 1.2.1 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5163 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 53d44a1617c5 Credits István Márton...

CISA Announces Launch of Logging Made Easy

Today, CISA announces the launch of a new version of Logging Made Easy LMElink is external, a straightforward log management solution for Windows-based devices that can be downloaded and self-installed for free. CISA’s version reimagines technology developed by the United Kingdom’s National Cyber...

WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)

Software Seraphinite Accelerator Type Plugin Vulnerable versions = 2.20.28 Fixed in 2.20.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5609 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 26fc0a7a4828 Credits...

SugarCRM 13.0.1 Shell Upload

------------------------------------------------------------------------------- SugarCRM = 13.0.1 setnoteattachment Unrestricted File Upload Vulnerability ------------------------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions:...

WordPress Article analytics Plugin <= 1.0 is vulnerable to SQL Injection

Software Article analytics Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5640 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 78430de01615 Credits Nicolas Surribas Required privilege Unauthenticate...

WordPress ICS Calendar Plugin <= 10.12.0.3 is vulnerable to Arbitrary File Download

Software ICS Calendar Type Plugin Vulnerable versions = 10.12.0.3 Fixed in 10.12.0.4 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2023-46784 Patch priority Medium CVSS severity Medium 8.2 Developer Claim ownership PSID 662755066f6f Credits Muhammad Daffa Require...

Fedora: Security Advisory for dotnet6.0 (FEDORA-2023-dcf59d2db2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress 404 Solution Plugin < 2.34.0 is vulnerable to SQL Injection

Software 404 Solution Type Plugin Vulnerable versions 2.34.0 Fixed in 2.34.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 0d83dbf66dc5 Credits WordFence Required privilege Administrator Published 26 October...

WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5820 Patch priority Low CVSS severity Low 10 Developer Claim ownership PSID 5ea4464f8b32 Credits Ala Arfaoui Required privilege...