CVE-2023-28854 nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function...

PT-2023-9329 · Apache +5 · Apache Http Server +5

Name of the Vulnerable Software and Affected Versions: mod auth openidc versions 2.0.0 through 2.4.13.1 Description: The issue is related to the mod auth openidc module for the Apache 2.x HTTP server, which implements OpenID Connect Relying Party functionality. When OIDCStripCookies is set and a...

PT-2023-21997 · Wagtail · Wagtail

Name of the Vulnerable Software and Affected Versions: Wagtail versions 1.5 through 4.1.3 Wagtail versions 1.5 through 4.2.1 Description: A stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account...

PT-2023-20704 · Dupeoff.Com · Dupeoff

Name of the Vulnerable Software and Affected Versions: DupeOff.Com DupeOff plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For DupeOff.Com DupeOff plugin...

PT-2023-17247 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: firefly-iii/firefly-iii versions prior to 6.0.0 Description: The issue is related to improper input validation in the firefly-iii/firefly-iii GitHub repository. Recommendations: For versions prior to 6.0.0, update to version 6.0.0 or later to...

PT-2023-17215 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS - Generic. It affects the thorsten/phpmyfaq GitHub repository. Recommendations: For versions prior to 3.1.12, update to version 3.1.12 or...

PT-2023-17222 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper privilege management, allowing any user who can add a new user to create a user with super admin rights. This has been fixed in version 3.1.12. Recommendation...

PT-2023-19560 · Oceanwp · Oceanwp Ocean Extra

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher authentication levels. There is no information provided about the...

PT-2023-15314 · Unknown · Wpdevart Booking Calendar +1

Name of the Vulnerable Software and Affected Versions: WpDevArt Booking calendar, Appointment Booking System plugin versions 3.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with edit...

PT-2023-20590 · Forcepoint · Forcepoint Web Security +1

Name of the Vulnerable Software and Affected Versions: Forcepoint Cloud Security Gateway CSG versions prior to 03/29/2023 Forcepoint Web Security versions prior to 03/29/2023 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site...

PT-2023-15419 · WordPress · Jeffrey-Wp Media Library Categories

Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions prior to 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For...

PT-2023-14646 · Thimpress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes plugin versions prior to 1.34 Description: The issue is related to an SQL Injection vulnerability in the ThimPress WP Pipes plugin, which can be exploited by authenticated administrators. This vulnerability allows for the...

PT-2023-17183 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.20 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository pimcore/pimcore. This is a type of security vulnerability that can allow an attacker to inject maliciou...

SUSE-SU-2023:1628-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23471: Fixed host memory exhaustion through Terminal resize goroutine leak bsc1206235. - Re-build containerd to use updated golang-packaging jsc1342. - Update to containerd v1.6.16 for Docker v23.0.0-ce...

PT-2023-20273 · Veracode · Veracode Scan Jenkins Plugin

Name of the Vulnerable Software and Affected Versions: Veracode Scan Jenkins Plugin versions prior to 23.3.19.0 Description: The issue allows users with access to view the job log to discover proxy credentials under specific configurations. This includes when the "Connect using proxy" option is...

PT-2023-16189 · WordPress · Ooohboi Steroids For Elementor

Name of the Vulnerable Software and Affected Versions: OoohBoi Steroids for Elementor WordPress plugin versions prior to 2.1.5 Description: The issue concerns CSRF and broken access control vulnerabilities. These vulnerabilities allow a user with a role as low as a subscriber to delete attachment...

PT-2023-16308 · WordPress · Hm Portfolio

Name of the Vulnerable Software and Affected Versions: HT Portfolio WordPress plugin versions prior to 1.1.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

PT-2023-21632 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A buffer overflow issue was addressed with improved memory handling. This issue may allow an app to cause unexpected system termination or write kernel memory. Recommendations: For macOS versions prio...

PT-2023-16238 · WordPress · Shortcode Menu

Name of the Vulnerable Software and Affected Versions: menu shortcode WordPress plugin version 1.0 and earlier Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its bloc...

PT-2023-15192 · WordPress · Contempoinc Real Estate 7

Name of the Vulnerable Software and Affected Versions: Contempoinc Real Estate 7 WordPress theme versions 3.3.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on the...