Privilege escalation

Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app...

CVE-2023-34157

Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app...

CVE-2023-34157

Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app...

PT-2023-20717 · Amember · Amember

Name of the Vulnerable Software and Affected Versions: asMember plugin versions = 1.5.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For asMember plugin versions = 1.5.4, update ...

PT-2023-24698 · Unknown · Hwwatchhealth

Name of the Vulnerable Software and Affected Versions: HwWatchHealth affected versions not specified Description: The issue concerns the HwWatchHealth being hijacked, which upon successful exploitation, may cause repeated pop-up windows of the app. Recommendations: At the moment, there is no...

HuTool XML parsing module has blind XXE vulnerability

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference...

CVE-2023-23802

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Easy GA4 Google Analytics 4 plugin = 1.0.6 versions...

PT-2023-23737 · Zhong Bang · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A vulnerability was found in the function put image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The...

CVE-2023-26528

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in jinit9906 Shipyaari Shipping Management plugin = 1.0 versions...

CVE-2023-23831

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rating-Widget Rating-Widget: Star Review System plugin = 3.1.9 versions...

CVE-2023-2277

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and...

PT-2023-22956 · WordPress · Phan Chuong Ip Metaboxes

Name of the Vulnerable Software and Affected Versions: Phan Chuong IP Metaboxes plugin versions = 2.1.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

CVE-2023-2289

The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘searchterm’ parameter in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2023-2275

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'getitem', 'getordernotes' and 'addordernote' functions in versions up to, and including, 1.5.3. This makes it possibl...

CVE-2023-1917

The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-34961

Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting XSS vulnerability via the /feedback/comment field...

PT-2023-11869 · Unknown · Newsletter Manager

Name of the Vulnerable Software and Affected Versions: Newsletter Manager versions up to, and including, 1.5.1 Description: The issue is related to insecure deserialization. This is caused by unsanitized input from the customFieldsDetails parameter being passed through a deserialization function,...

up-front-works.jp Cross Site Scripting vulnerability OBB-3392336

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-10292 · WordPress · Woosidebars Plugin

Name of the Vulnerable Software and Affected Versions: WooSidebars Plugin versions up to 1.4.1 Description: A problematic issue has been found in the WooSidebars Plugin on WordPress, affecting the function enable custom post sidebars of the file classes/class-woo-sidebars.php. The manipulation of...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that stems from the risk of hijacking the HwWatchHealth app, which can be exploited by an attacker to...