‼ CVE-2023-34036 ‼
📖 Read
via "National Vulnerability Database".
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23646 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions.📖 Read
via "National Vulnerability Database".
⚠ Zimbra Collaboration Suite warning: Patch this 0-day right now (by hand)! ⚠
📖 Read
via "Naked Security".
Zimbra didn't actually say, "Do not delay/Do it today," but they did say, "We kindly request your cooperation to apply the fix manually."📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-27424 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin <=Â 1.59 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2912 ‼
📖 Read
via "National Vulnerability Database".
Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2959 ‼
📖 Read
via "National Vulnerability Database".
Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31851 ‼
📖 Read
via "National Vulnerability Database".
Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3186 ‼
📖 Read
via "National Vulnerability Database".
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3376 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection.This issue affects Zekiweb: before 2.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36511 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <=Â 1.6.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37968 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <=Â 1.3.39 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2701 ‼
📖 Read
via "National Vulnerability Database".
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3418 ‼
📖 Read
via "National Vulnerability Database".
The Querlo Chatbot WordPress plugin through 1.2.4 does not escape or sanitize chat messages, leading to a stored Cross-Site Scripting vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2579 ‼
📖 Read
via "National Vulnerability Database".
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35089 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <=Â 8.0.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3041 ‼
📖 Read
via "National Vulnerability Database".
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35096 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <=Â 2.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35880 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <=Â 1.6.49 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31216 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <=Â 2.6.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36513 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <=Â 5.7.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31853 ‼
📖 Read
via "National Vulnerability Database".
Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.📖 Read
via "National Vulnerability Database".