Archive
27 November 2023
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Medium —
aiohttp has vulnerable dependency that is vulnerable to request smuggling
### Summary llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).
-
High 7.9
Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSO…
-
Medium 6.5
Franklin Electric Fueling Systems Colibri Path Traversal
The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.
-
Medium 5.0
OroCalendarBundle has incorrect system calendar events visibility
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in…
-
High 8.6
OroPlatform vulnerable to path traversal during temporary file manipulations
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacke…
-
Medium —
Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
### Impact The `Validator.isValidSafeHTML` method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because thi…
-
Medium —
Uptime Kuma Authenticated remote code execution via TailscalePing
### Summary The `runTailscalePing` method of the `TailscalePing` class injects the `hostname` parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. ### Details When adding a new monitor o…
-
Critical 9.8
Arcserve UDP Agent Unauthenticated Path Traversal File Upload
Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP…
-
Critical 9.8
Arcserve UDP Management Authentication Bypass
An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication.
-
Critical 9.8CVE-2023-41998 EPSS 15%
Arcserve UDP Unauthenticated RCE
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.
-
Critical 9.8
Control iD iDSecure passwordCustom Authentication Bypass
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentic…
-
Unscored —
Webpushr < 4.35.0 - Unauthenticated Stored XSS
The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.
-
Medium 4.3
Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update
The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
-
Unscored —
Martins Free & Easy SEO Link buildings < 1.2.30 - Reflected XSS
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege us…
-
Unscored —CVE-2023-5559 Scanner template
10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
-
Medium 4.8
Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f…
-
Medium 5.4
Medialist < 1.4.1 - Contributor+ Stored XSS
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cr…
-
Unscored —
Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them
-
Unscored —
Mmm Simple File List <= 2.3 - Contributor+ Stored XSS
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform…
-
Unscored —
WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
-
Unscored —CVE-2023-4922 EPSS 16%
WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion
The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.
-
Unscored —
Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
-
Unscored —
POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
-
Medium 5.3
Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
-
Unscored —CVE-2023-5974 Scanner template
WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery
The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.
-
Unscored —
WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
-
Medium 4.3
Mmm Simple File List <= 2.3 - Subscriber+ Arbitrary Directory Listing
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
-
Unscored —
WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
-
Critical 9.8
Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to…
-
Unscored —
Security & Malware scan by CleanTalk < 2.121 - IP Spoofing
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
-
Unscored —
WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
-
Unscored —
EventPrime <= 3.2.9 - Booking Pricing Bypass
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
-
Unscored —
Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because i…
-
Unscored —
Bookly < 22.5 - Admin+ Stored XSS
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_htm…
-
Unscored —
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition.
-
High 8.8
An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data ele…
-
High 8.8
A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted ma…
-
High 8.8CVE-2023-35985 Public exploit
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due…
-
High 8.8
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due…
-
High 8.8
A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted …