WordPress WP Meta SEO Plugin <= 4.5.2 is vulnerable to SQL Injection

Software WP Meta SEO Type Plugin Vulnerable versions = 4.5.2 Fixed in 4.5.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID ed22c0b021d4 Credits WordFence Required privilege Subscriber Published 23 February,...

WordPress Upload Resume Plugin <= 1.2.0 is vulnerable to Sensitive Data Exposure

Software Upload Resume Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-25965 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 22453b4ef9ac Credits MyungJu Kim Required privileg...

WordPress GMAce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software GMAce Type Plugin Vulnerable versions = 1.5.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23861 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5e49c5295a88 Credits Mika Required privilege...

WordPress CPT – Speakers Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software CPT – Speakers Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25977 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3e1184654a6a Credits Mahesh Nagabhairava Required...

Cross site scripting

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting XSS. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted i...

@roots/bud-imagemin (2023.2.13) potentially affected by unknown CVE via @roots/bud (2023.2.13)

@roots/bud NPM version 2023.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @roots/bud and may be impacted: - @roots/bud-imagemin 2023.2.13 Source cves: unknown CVE Source advisory: SNYK:JS-ROOTSBUD-3326363...

WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Advanced Database Cleaner Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46813 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f4bc8afbea0f Credits thiennv...

WordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Visualizer Type Plugin Vulnerable versions = 3.9.4 Fixed in 3.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23708 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0daddcc471b Credits Rafshanzani Suhada Required...

WordPress Easy Google Analytics for WordPress Plugin <= 1.6.0 is vulnerable to Broken Access Control

Software Easy Google Analytics for WordPress Type Plugin Vulnerable versions = 1.6.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23887 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 682fb3f4795d Credits Mika Requir...

WordPress Sponsors Carousel Plugin <= 4.02 is vulnerable to Cross Site Scripting (XSS)

Software Sponsors Carousel Type Plugin Vulnerable versions = 4.02 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23808 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 268e027bdd31 Credits Rio Darmawan Required...

WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23820 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1dded0badc30 Credits Rafie Muhammad Patchstack...

CVE-2022-48115

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

WordPress Simple PDF Viewer Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)

Software Simple PDF Viewer Type Plugin Vulnerable versions = 1.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23817 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 65a3708bedaf Credits István Márton Required...

IBM Maximo Asset Management 信息泄露漏洞

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from International Business Machines IBM. IBM Maximo Asset Management version 7.6.1.2 and 7.6.1.3 are vulnerable to information disclosure. The vulnerability stems from the program's inadequate...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +10 more potentially affected by CVE-2025-27098 via @graphql-mesh/cli (>=0.78.0, <=0.82.21)

@graphql-mesh/cli NPM version =0.78.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20, =2.2.6-alpha-20220906004558-09c8599,...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-48306 Gotham Chat IRC help does not validate hostnames in TLS certificates

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept...

SUSE CVE-2013-4076

Buffer overflow in the dissectiphccrtpfh function in epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service application crash via a crafted packet...

SUSE CVE-2014-1700

Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure...

SUSE CVE-2015-7579

Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class...