517 matches found
CVE-2023-50937
IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117...
PT-2024-6579 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of Cross-Origin Resource Sharing CORS in IBM PowerSC, which could allow an attacker to carry out privileged actions and retrieve sensitive information. This is...
PT-2024-15035 · WordPress · Site Notes
Name of the Vulnerable Software and Affected Versions: The Site Notes WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of CSRF checks in some functionalities of the plugin, which could allow attackers to make logged-in users perform unwanted actions, such as deleting...
WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection
Software EnvíaloSimple Type Plugin Vulnerable versions = 2.1 Fixed in 2.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-51414 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 134713a86bde Credits Rafie Muhammad Patchstack Required privilege...
Privilege escalation
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently...
CVE-2023-45083 HyperCloud: "admin" and "serveradmin" users can be deleted
An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in phoeniixx Custom My Account for Woocommerce allows Cross-Site Scripting XSS.This issue affects Custom My Account for Woocommerce: from n/a through 2.1...
CVE-2023-5443
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...
PT-2023-32109
Name of the Vulnerable Software and Affected Versions EDM Informatics E-invoice versions prior to 2.1 Description The issue is related to improper protection for outbound error messages and alert signals, allowing account footprinting. This can potentially reveal sensitive information about user...
Infodrom Software E-Invoice Approval System Security Breach
Infodrom Software E-Invoice Approval System is an electronic invoice approval system from Infodrom Software, Turkey. A security vulnerability exists in Infodrom Software E-Invoice Approval System version 2.1 that stems from improper protection of outbound error messages and alert signals...
CVE-2023-41650
Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...
WordPress Feeds for YouTube Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)
Software Feeds for YouTube Type Plugin Vulnerable versions = 2.1 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4841 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9fd258b26a01 Credits Lana Codes Required...
CVE-2023-35065
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Osoft Paint Production Management allows SQL Injection.This issue affects Paint Production Management: before 2.1...
WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Remove/hide Author, Date, Category Like Entry-Meta Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41650 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...
CVE-2023-34175 WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in GrandSlambert Login Configurator plugin = 2.1 versions...
CVE-2023-4276 Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change
The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...
MOXA NPort IAW5000A-I/O Series Improper Privilege Management (CVE-2020-25194)
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges. This plugin only works with Tenable.ot. Please visit...
PT-2023-11903 · Duxcms · Duxcms
Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. This enables attackers to execute malicious scripts on th...