CVE-2023-52123

CVE-2023-52123 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WPChill Strong Testimonials, affecting version 3.1.10 and earlier. Per NVD, impact is high (C/H/I/H) with CVSS 3.1 base score 8.8. PatchStack documents a lower severity (CVSS 3.1 base 4.3) and notes...

CVE-2023-52123 WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10...

PT-2024-14420 · Wpchill · Wpchill Strong Testimonials

Name of the Vulnerable Software and Affected Versions: WPChill Strong Testimonials versions 3.1.10 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application th...

WordPress Plugin Strong Testimonials Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress Plugin Strong Testimonials suffers from a...

WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Strong Testimonials Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52123 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6a5da45fead3 Credits Brandon Rolda...

PT-2023-27229 · Arris · Arris Dg860A +1

Name of the Vulnerable Software and Affected Versions: Arris DG860A affected versions not specified Arris DG1670A affected versions not specified Description: The devices have predictable default WPA2 PSKs, which could lead to unauthorized remote access. They use the first 6 characters of the SSI...

Exploitation of Unitronics PLCs used in Water and Wastewater Systems

CISA is responding to active exploitationlink is external of Unitronics programmable logic controllers PLCs used in the Water and Wastewater Systems WWS Sector. Cyber threat actors are targeting PLCs associated with WWS facilities, including an identified Unitronics PLC, at a U.S. water facility...

The vulnerability of the _nginxCmd() function of the Nginx web server control software, specifically the strong-nginx-controller, allows attackers to execute arbitrary commands.

The vulnerability of the nginxCmd function of the Nginx web server control software exists because measures to neutralize specific elements have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Automatic Conditional Access policies in Microsoft Entra streamline identity protection

Extending our commitment to help customers be secure by default, today were announcing the auto-rollout of Microsoft Entra Conditional Access policies that will automatically protect tenants based on risk signals, licensing, and usage. Weve designed these policies based on our deep knowledge of t...

Arbitrary File Read Vulnerability in Teaching Affairs Integration System of Hunan Qiangzhi Technology Development Co.

Founded in 2002, Hunan Strong Intelligence Technology Development Co., Ltd. is a leading provider of educational informatization services in the industry. Ltd. is a leading provider of educational informatization services. An arbitrary file read vulnerability exists in the Hunan Strong Intelligen...

Design/Logic Flaw

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

CVE-2023-46249 authentik potential installation takeover when default admin user is deleted

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the...

PT-2023-6357 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: An issue was discovered that allows attackers to gain escalated privileges on the device via poor credential management. This is related to weak password requirements. Exploitation of...

No rate limiting on creating access token

Description: Access token creation is a critical security component in many applications, especially when it comes to user authentication and authorization. Without proper rate limiting controls, attackers may exploit this process to launch various types of attacks, such as brute force attacks,...

PT-2023-27230 · Arris · Arris Tg862G +2

Name of the Vulnerable Software and Affected Versions: ARRIS TG852G affected versions not specified ARRIS TG862G affected versions not specified ARRIS TG1672G affected versions not specified Description: A remote attacker in proximity to a Wi-Fi network can derive the default WPA2-PSK value by...

A history of ransomware: How did it get this far?

Today's ransomware is the scourge of many organizations. But where did it start? If we define ransomware as malware that encrypts files to extort the owner of the system, then the first malware that could be classified as ransomware is the 1989 AIDS Trojan. However, while it encrypted filenames a...

The Bug Report – August 2023 Edition

The Bug Report – August 2023 Edition By Charles McFarland · September 06, 2023 Why am I here? Welcome back to The Bug Report, the hotter-than-hell Texas edition! For those still unfamiliar with our monthly escapades, every month our trusty Advanced Research Center vulnerability research team...

Discord.io confirms theft of 760,000 members' data

Discord.io was/is a third party service that enables owners of Discord servers to create customized, personal Discord invites. After a preview of Discord.io's users database was posted on BreachForums, the owners have decided to shut down all Discord.io services "for the foreseeable future."...

PT-2023-5021 · Harman · Harman Infotainment

Name of the Vulnerable Software and Affected Versions: Harman Infotainment version 20190525031613 Description: The issue allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name. This is related to inadequate access control in the navigation and...

WordPress Strong Testimonials Plugin < 2.40.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:machothemes:strongtestimonials"; ifdescription...