Medium: opensmtpd

Issue Overview: asciiloadsockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable through 7.0.0-portable, can abort upon a connection from a local, scoped IPv6 address. CVE-2023-29323 Affected Packages: opensmtpd Issue Correction: Run dnf update opensmt...

PT-2023-22260 · WordPress · Flyn San Iframe Shortcode

Name of the Vulnerable Software and Affected Versions: Flyn San IFrame Shortcode plugin versions 1.0.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to b...

PT-2023-17405 · Tenable · Tenable.Io +2

Name of the Vulnerable Software and Affected Versions: Tenable.Io versions before Plugin Feed ID 202306261202 Tenable Nessus versions before Plugin Feed ID 202306261202 Tenable Security Center versions before Plugin Feed ID 202306261202 Description: This issue could allow a malicious actor with...

PT-2023-27522 · Owasp · Owasp Coraza Waf

Name of the Vulnerable Software and Affected Versions: OWASP Coraza WAF versions prior to 3.0.1 Description: The issue is caused by the misuse of log.Fatalf in the OWASP Coraza WAF library, which leads to the application crashing after receiving crafted requests from attackers. The application wi...

PT-2023-22251 · Plainware · Plainware Shiftcontroller Employee Shift Scheduling

Name of the Vulnerable Software and Affected Versions: Plainware ShiftController Employee Shift Scheduling plugin versions = 4.9.23 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects...

OpenCart 1.4.7 < 2.0.0.0 Directory Traversal Vulnerability

OpenCart is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:opencart:opencart"; if...

Fedora 38 : vim (2023-6ad6467a06)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-6ad6467a06 advisory. The newest upstream commit 2215591 - TRIAGE vim: Divide By Zero vulnerability in scrollcursorbot in move.c Tenable has extracted the preceding description...

PT-2023-24631 · Unknown · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor Premium Addons PRO plugin versions = 2.8.24 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scrip...

PT-2023-21938 · WordPress · Wpmet Wp Ultimate Review

Name of the Vulnerable Software and Affected Versions: Wpmet Wp Ultimate Review plugin versions = 2.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Wpmet Wp Ultimate Review...

PT-2023-23235 · WordPress · Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder plugin versions prior to 6.13.0 Description: A Stored Cross-Site Scripting XSS vulnerability exists, affecting users with contributor or higher permissions. This issue allows for malicious script execution...

PT-2023-20710 · WordPress · Onewebsite Wp Repost

Name of the Vulnerable Software and Affected Versions: OneWebsite WP Repost plugin versions 0.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For OneWebsite WP Repost...

PT-2023-19210 · WordPress · Muneeb Form Builder

Name of the Vulnerable Software and Affected Versions: Muneeb Form Builder plugin versions = 1.9.9.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...

PT-2023-21783 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal plugin versions prior to 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into the website, which can then be...

PT-2023-21662 · WordPress · Bookit

Name of the Vulnerable Software and Affected Versions: BookIt plugin for WordPress versions up to, and including, 2.3.7 Description: The BookIt plugin for WordPress has an authentication bypass issue due to insufficient verification of the user being supplied during booking an appointment through...

PT-2023-21117 · WordPress · Jetpack Crm

Name of the Vulnerable Software and Affected Versions: Jetpack CRM plugin versions prior to 5.4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 5.4.4, update...

PT-2023-3411 · Cloudflare · Cloudflare Warp Client For Windows

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP client for Windows versions up to 2023.3.381.0 Description: The issue is related to insufficient access control policy on an IPC Named Pipe, allowing a malicious actor to remotely access the warp-svc.exe binary. This could...

KLA50365 ACE vulnerability in LibreOffice

Improper Input Validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Arbitrary File Write in hsqldb 1.8.0 Related products LibreOffice CVE list CVE-2023-1183 high Solution Update to the latest version...

PT-2023-19901 · Unknown · Amit Agarwal Google Xml Sitemap For Images

Name of the Vulnerable Software and Affected Versions: Amit Agarwal Google XML Sitemap for Videos plugin versions = 2.6.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

Home Assistant < 0.67.0 Information Disclosure Vulnerability

Home Assistant is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Home Assistant < 0.57 XSS Vulnerability

Home Assistant is prone to a cross-site scription XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...