CVE-2023-34374

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Rahul Aryan AnsPress plugin = 4.3.0 versions...

CVE-2023-24009

Auth. subscriber+ Reflected Cross-site Scripting XSS vulnerability in Wpazure Themes Upfrontwp theme = 1.1 versions...

up-map.it Cross Site Scripting vulnerability OBB-3573203

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-31221

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ransom Christofferson PDQ CSV plugin = 1.0.0 versions...

CVE-2023-27415

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Themeqx LetterPress plugin = 1.1.2 versions...

CVE-2023-27421

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Everest themes Everest News theme = 1.1.0 versions...

CVE-2023-27416

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Decon Digital Decon WP SMS plugin = 1.1 versions...

WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sign-up Sheets Type Plugin Vulnerable versions = 2.2.8 Fixed in 2.2.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39165 Patch priority Low CVSS severity Low 5.4 Developer Fetch Designs PSID 3cb2a78e83f5 Credits Nguyen Xuan Chien...

PT-2023-4946 · Qemu +9 · Qemu +9

Name of the Vulnerable Software and Affected Versions: QEMU versions through 8.0.0 Description: The issue is related to a division by zero in the scsi disk reset function in hw/scsi/scsi-disk.c due to incorrect block size checking by scsi disk emulate mode select. This can cause QEMU and the gues...

Inventory Management System SQL注入漏洞

Inventory Management System is an inventory management system. A SQL injection vulnerability exists in Inventory Management System version 1.0, which originates from a SQL injection via the uppid parameter on the editsell.php page. No details of the vulnerability are available at this time...

PT-2023-28113 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical issue was found in the SourceCodester Inventory Management System, affecting the file edit sell.php. The manipulation of the up pid argument leads to SQL injection...

up-armored.com Cross Site Scripting vulnerability OBB-3568789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-27853 · Byzoro · Byzoro Smart S85F Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform versions up to 20230722 Description: A critical issue affects the processing of the file importhtml.php, where the manipulation of the sql argument leads to command injection. The attack can be initiated...

WordPress Pop-up Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Pop-up Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 756751a5022f Credits WordFence Required privilege...

WordPress Pop-up Plugin <= 1.1.9 is vulnerable to Broken Access Control

Software Pop-up Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6c527b0974ca Credits WordFence Required privilege Subscriber...

PT-2023-26491 · WordPress · Ultimate Social Media Plus +1

Name of the Vulnerable Software and Affected Versions: Ultimate Social Media Plus plugin versions through 3.5.7 Social Share Icons & Social Share Buttons versions through 3.5.7 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configur...

CVE-2023-39155

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

Deserialization of untrusted data

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

PT-2023-33059 · Amazon · S2N-Quic

Name of the Vulnerable Software and Affected Versions: s2n-quic versions =v1.24.0 Description: The issue in s2n-quic causes the endpoint to shut down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected, an...

PT-2023-6727 · Dahua · Dahua Smart Parking Management

Name of the Vulnerable Software and Affected Versions: Dahua Smart Park Management versions up to 20230713 Description: The issue is related to an unrestricted file upload vulnerability in the /emap/devicePoint addImgIco?hasSubsystem=true file, which can be exploited remotely. This vulnerability...