CVE-2023-34099 Improper mail validation in Shopware

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7....

PT-2023-20551 · WordPress · Kivicare

Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue allows low-privilege users, such as subscribers, to retrieve sensitive information of other users, including email and hashed password, due to the lack of restriction on...

PT-2023-22496 · WordPress · Jetpack

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 12.1.1 Description: The issue allows users with author roles or above to manipulate existing files on the site, including deleting arbitrary files. In rare cases, it can also lead to Remote Code...

PT-2023-18882 · WordPress · Gsheetconnector-Gravityforms-Pro +1

Name of the Vulnerable Software and Affected Versions: Gravity Forms Google Sheet Connector WordPress plugin versions prior to 1.3.5 gsheetconnector-gravityforms-pro WordPress plugin versions prior to 1.3.5 Description: The issue concerns a lack of CSRF check when updating the Access Code,...

PT-2023-17429 · WordPress · Custom 404 Pro

Name of the Vulnerable Software and Affected Versions: Custom 404 Pro WordPress plugin versions prior to 3.8.1 Description: The issue is related to improper sanitization of database inputs, leading to multiple SQL Injection vulnerabilities. This allows attackers to inject malicious SQL code,...

Low: runc

Issue Overview: No CVE associated with this advisory Affected Packages: runc Issue Correction: Run dnf update runc --releasever 2023.1.20230628 or dnf update --advisory ALAS2023-2023-231 --releasever 2023.1.20230628 to update your system. More information on how to update your system can be found...

PT-2023-4068 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

PT-2023-21706 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.14 Description: The issue allows attackers to make logged-in admins delete Inventory Items via a CSRF attack due to the lack of CSRF checks. Recommendations: For versions prior to 2.1.0.14, update ...

PT-2023-4044 · Siemens · Ruggedcom Rox Rx1500 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

PT-2023-22260 · WordPress · Flyn San Iframe Shortcode

Name of the Vulnerable Software and Affected Versions: Flyn San IFrame Shortcode plugin versions 1.0.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to b...

PT-2023-17405 · Tenable · Tenable.Io +2

Name of the Vulnerable Software and Affected Versions: Tenable.Io versions before Plugin Feed ID 202306261202 Tenable Nessus versions before Plugin Feed ID 202306261202 Tenable Security Center versions before Plugin Feed ID 202306261202 Description: This issue could allow a malicious actor with...

PT-2023-22612 · Openwb · Openwb

Name of the Vulnerable Software and Affected Versions: OpenWB versions 1.6 through 1.7 Description: The issue allows remote attackers to run arbitrary commands via crafted GET requests, potentially leading to command injection attacks. Recommendations: For OpenWB versions 1.6 through 1.7, update ...

PT-2023-15437 · Inspireui · Inspireui Mstore Api Plugin

Name of the Vulnerable Software and Affected Versions: InspireUI MStore API plugin versions prior to 3.9.8 Description: The issue is related to an unauthorized SQL Injection vulnerability in the InspireUI MStore API plugin. Recommendations: For versions prior to 3.9.8, update to version 3.9.8 or...

PT-2023-19221 · Qumos · Qumos Mojoplug Slide Panel Plugin

Name of the Vulnerable Software and Affected Versions: Qumos MojoPlug Slide Panel plugin versions prior to 1.1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For Qumos MojoPlug...

PT-2023-25139 · Stylemixthemes · Stylemixthemes Masterstudy Lms Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin versions prior to 3.0.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or highe...

PT-2023-21140 · Unknown · Wow-Company Button Generator

Name of the Vulnerable Software and Affected Versions: Wow-Company Button Generator – easily Button Builder plugin versions prior to 2.3.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For...

PT-2023-21607 · Unknown · Wp Chill Brilliance

Name of the Vulnerable Software and Affected Versions: WP Chill Brilliance theme versions prior to 1.3.1 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authenticated users with subscriber or higher privileges to inject malicious scripts. Recommendations: For WP Chil...

PT-2023-11379 · Woocommerce · Abandoned Cart Pro For Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Lite for WooCommerce versions up to, and including, 5.1.3 Abandoned Cart Pro for WooCommerce versions up to, and including, 7.12.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input...

SUSE: Security Advisory (SUSE-SU-2023:2578-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:2579-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Version update from 8.5.22 to 9.5.1 jscPED-3694: Security fixes: - CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip bsc1209645 - CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request...