GHSA-6XV5-86Q9-7XR8 vulnerabilities

Vulnerabilities for packages: ctop, k3s, up...

GHSA-6XV5-86Q9-7XR8 vulnerabilities

Vulnerabilities for packages: up, k3s, ctop...

Oracle Linux 8 : freeradius:3.0 (ELSA-2019-3353)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3353 advisory. - It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of t...

Design/Logic Flaw

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2023-39264 Apache Superset: Stack traces enabled by default

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0...

apr: Windows out-of-bounds write in apr_socket_sendv function

A flaw was found in Apache Portable Runtime, affecting versions = 1.7.0. This issue may allow a malicious user to write beyond the end of a stack buffer and cause an integer overflow. This affects Windows environments...

CVE-2023-30485

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Solwin Infotech Responsive WordPress Slider – Avartan Slider Lite plugin = 1.5.3 versions...

CVE-2023-40208

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aleksandar Urošević Stock Ticker plugin = 3.23.3 versions...

CVE-2023-40206

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post plugin = 1.0.3 versions...

PT-2023-30464 · Yonyou · Yongyou Ufida-Nc

Name of the Vulnerable Software and Affected Versions: Yongyou UFIDA-NC versions up to 20230807 Description: A critical issue has been found in the processing of the file PrintTemplateFileServlet.java, where the manipulation of the filePath argument leads to path traversal. This issue can be...

PT-2023-23242 · Wp Experts.In Team · Wp Categories Widget

Name of the Vulnerable Software and Affected Versions: WP-EXPERTS.IN TEAM WP Categories Widget plugin versions = 2.2 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

CVE-2023-38516

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

PT-2023-30453 · Byzoro · Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230822 Description: A critical issue affects some unknown functionality of the file /importexport.php, leading to sql injection. The attack can be...

PT-2023-19022 · WordPress · Chp Ads Block Detector

Name of the Vulnerable Software and Affected Versions: CHP Ads Block Detector plugin for WordPress versions up to, and including, 3.9.4 Description: The issue is related to Stored Cross-Site Scripting via admin settings reachable through an AJAX action due to insufficient input sanitization and...

PT-2023-27200 · WordPress · The Waiting

Name of the Vulnerable Software and Affected Versions: The Waiting: One-click countdowns plugin for WordPress versions up to, and including, 0.6.2 Description: The issue is due to missing or incorrect nonce validation on its AJAX actions, making it possible for unauthenticated attackers to create...

CVE-2023-25453

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ian Sadovy WordPress Tables plugin = 1.3.9 versions...

CVE-2023-33320

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Mohammad I. Okfie WP-Hijri plugin = 1.5.1 versions...

CVE-2023-25462

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP htaccess Control plugin = 3.5.1 versions...

PT-2023-19869 · Premio · Premio Chaty Plugin

Name of the Vulnerable Software and Affected Versions: Premio Chaty plugin versions 3.0.9 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-24638 · WordPress · Miled Wordpress Social Login

Name of the Vulnerable Software and Affected Versions: Miled WordPress Social Login plugin versions = 3.0.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...