‼ CVE-2022-41976 ‼
📖 Read
via "National Vulnerability Database".
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change role (e.g., to administrator) by updating their user profile.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0157 ‼
📖 Read
via "National Vulnerability Database".
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1478 ‼
📖 Read
via "National Vulnerability Database".
The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25392 ‼
📖 Read
via "National Vulnerability Database".
Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1120 ‼
📖 Read
via "National Vulnerability Database".
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0983 ‼
📖 Read
via "National Vulnerability Database".
The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0605 ‼
📖 Read
via "National Vulnerability Database".
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29376 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potential XSS by privileged users in Sitefinity to media libraries.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1406 ‼
📖 Read
via "National Vulnerability Database".
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1122 ‼
📖 Read
via "National Vulnerability Database".
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0156 ‼
📖 Read
via "National Vulnerability Database".
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4827 ‼
📖 Read
via "National Vulnerability Database".
The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29375 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1381 ‼
📖 Read
via "National Vulnerability Database".
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1425 ‼
📖 Read
via "National Vulnerability Database".
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1121 ‼
📖 Read
via "National Vulnerability Database".
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0893 ‼
📖 Read
via "National Vulnerability Database".
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24181 ‼
📖 Read
via "National Vulnerability Database".
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0546 ‼
📖 Read
via "National Vulnerability Database".
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.📖 Read
via "National Vulnerability Database".
🕴 How and Why to Put Multicloud to Work 🕴
📖 Read
via "Dark Reading".
Complex multicloud environments present organizations with security challenges, but also opportunities for efficiency.📖 Read
via "Dark Reading".
Dark Reading
How and Why to Put Multicloud to Work
Complex multicloud environments present organizations with security challenges, but also opportunities for efficiency.
🛠 AIDE 0.18.2 🛠
📖 Read
via "Packet Storm Security".
AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire(tm). It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms to ensure that the files have not been tampered with.📖 Read
via "Packet Storm Security".
Packetstormsecurity
AIDE 0.18.2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers