WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure

Software Cloud Templates & Patterns collection Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-47529 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

WordPress User Registration Plugin < 3.0.4.2 is vulnerable to Cross Site Scripting (XSS)

Software User Registration Type Plugin Vulnerable versions 3.0.4.2 Fixed in 3.0.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5228 Patch priority Low CVSS severity Low 5.9 Developer Masteriyo PSID b0a43efbedef Credits Mohamed Azarudheen Require...

Fedora 39 : python3.11 (2023-4953fc03b9)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4953fc03b9 advisory. Update to 3.11.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

WordPress TWB Woocommerce Reviews Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Software TWB Woocommerce Reviews Type Plugin Vulnerable versions = 1.7.5 Fixed in 1.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47653 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a756ef9307fc Credits Emili Castells...

WordPress Visitors Traffic Real Time Statistics Plugin <= 7.2 is vulnerable to Broken Access Control

Software Visitors Traffic Real Time Statistics Type Plugin Vulnerable versions = 7.2 Fixed in 7.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47557 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a6e4049fb1e4 Credits...

1E Platform Security Vulnerability

1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in versions prior to 1E Platform v18.1 that stems from a command that fails to properly validate input parameters, allowing specially crafted inputs to execute arbitrary code with system...

Fedora: Security Advisory for netconsd (FEDORA-2023-6b4d3ca766)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for mvfst (FEDORA-2023-7934802344)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for chromium (FEDORA-2023-7f87c8b975)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

F5 Networks BIG-IP : tcpdump vulnerability (K56551263)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.3.1 / 15.1.3 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K56551263 advisory. The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-...

solution-vertrieb.de Improper Access Control vulnerability OBB-3771432

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Huawei EulerOS: Security Advisory for procps-ng (EulerOS-SA-2023-3106)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2023-3101)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic...

WordPress The Plus Addons for Elementor Pro Plugin <= 5.2.8 is vulnerable to Local File Inclusion

Software The Plus Addons for Elementor Pro Type Plugin Vulnerable versions = 5.2.8 Fixed in 5.2.9 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-47178 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 0501be93705b Credits Rafie Muhammad...

Huawei EulerOS: Security Advisory for zstd (EulerOS-SA-2023-3046)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-46139

KernelSU (Android) prior to 0.7.0 is affected. The root cause is a mismatch in signature verification logic: the vulnerable path reads the last signing block with id 0x7109871a, while Android installation validates the first block, allowing a malware-signed block to bypass verification and escala...

WordPress Jquery news ticker Plugin <= 3.0 is vulnerable to SQL Injection

Software Jquery news ticker Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5430 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID f8ae8a455966 Credits István Márton Required privilege Contributor...

WordPress Weather Atlas Widget Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Weather Atlas Widget Type Plugin Vulnerable versions = 1.2.1 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5163 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 53d44a1617c5 Credits István Márton...

CISA Announces Launch of Logging Made Easy

Today, CISA announces the launch of a new version of Logging Made Easy LMElink is external, a straightforward log management solution for Windows-based devices that can be downloaded and self-installed for free. CISA’s version reimagines technology developed by the United Kingdom’s National Cyber...