Oracle MySQL 安全漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server version 8.0.30 and prior versions. An attacker with elevated privileges who accesses the network via multiple protocols can compromise MySQL Server...

WordPress Easy Accept Payments Plugin < 4.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Easy Accept Payments Type Plugin Vulnerable versions 4.9.10 Fixed in 4.9.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0275 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 334f1469f03f Credits Lana Codes...

WordPress MainWP Links Manager Extension Plugin <= 2.1 is vulnerable to Privilege Escalation

Software MainWP Links Manager Extension Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A8: Insecure Deserialization Classification Privilege Escalation CVE CVE-2023-23649 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 18ad4e4659ad Credits Dave Jong...

PT-2023-8517 · Pyload · Pyload

Name of the Vulnerable Software and Affected Versions: pyLoad versions prior to 0.5.0b3.dev78 Description: The issue is related to a Cross-Site Request Forgery CSRF attack. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities. Any API...

WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software TemplatesNext ToolKit Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22712 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9bfdd28ec3f2 Credits Rafshanzani Suhad...

WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection

Software Custom 404 Pro Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47605 Patch priority Low CVSS severity Low 8.3 Developer Kunal Nagar PSID 960f40facc61 Credits minhtuanact Required privilege Administrator Published...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache Foundation USA. A security vulnerability exists in Apache Superset versions 1.5.2 and earlier and 2.0.0, which originates from an authenticated attacker with write access to a CSS template that can create a reco...

PT-2023-7912 · WordPress · Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Show All Comments WordPress plugin version prior to 7.0.1 Description: The issue is related to a Reflected Cross-Site Scripting attack, which could be used against logged-in high-privilege users, such as admins. This occurs because the plugin...

WordPress DNUI Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software DNUI Type Plugin Vulnerable versions = 2.8.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47609 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID f2efe7cbc315 Credits Mika Required privilege...

WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Map Multi Marker Type Plugin Vulnerable versions = 3.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47591 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fa0897cb0de Credits minhtuanact Requir...

PT-2023-15569 · Unknown · Tramyardg Hotel-Mgmt-System

Name of the Vulnerable Software and Affected Versions: Tramyardg hotel-mgmt-system version 2022.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the process update profile.php file. Recommendations: For Tramyardg hotel-mgmt-system version 2022.4,...

WordPress WP-OliveCart Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP-OliveCart Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47435 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 10d7b9455c85 Credits Team WeBoB Required privileg...

WordPress Materialis Companion Plugin < 1.3.40 is vulnerable to Cross Site Scripting (XSS)

Software Materialis Companion Type Plugin Vulnerable versions 1.3.40 Fixed in 1.3.40 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4762 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80cd16937fbb Credits Lana Codes...

WordPress Launchpad – Coming Soon & Maintenance Mode Plugin Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Launchpad – Coming Soon & Maintenance Mode Plugin Type Plugin Vulnerable versions = 1.0.13 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0295 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1b5adaa47d4c...

WordPress Extra Block Design, Style, CSS for ANY Gutenberg Blocks Plugin <= 0.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Extra Block Design, Style, CSS for ANY Gutenberg Blocks Type Plugin Vulnerable versions = 0.2.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47183 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

WordPress Superior FAQ Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Superior FAQ Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22678 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ae6b745055b4 Credits NeginNrb Required...

WordPress Annual Archive Plugin < 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Annual Archive Type Plugin Vulnerable versions 1.6.0 Fixed in 1.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0178 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e447b05c3b01 Credits Lana Codes Required...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4865 more potentially affected by unknown CVE via tokio (>=0.2.0-alpha.1, <=1.18.2)

tokio CARGO version =0.2.0-alpha.1, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

WordPress YouTube Channel Plugin < 3.23.0 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Channel Type Plugin Vulnerable versions 3.23.0 Fixed in 3.23.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4756 Patch priority Medium CVSS severity Medium 6.3 Developer Aleksandar Urošević PSID 3866f6e0ecf5 Credits Lana Codes...

PT-2023-10612 · Unknown · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...