Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,451 results · page 101 of 390
Dec 31, 2023Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value.CVE-2021-46900 · Other software · Sympa · reported by MITREHigh 7.5
Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.
- Product
- Sympa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect.CVE-2023-52263 · Other software · Brave · reported by MITREMedium 6.1
Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023JSON Content Importer: Does not sanitise and escape the tab parameter before outputting it back in the pageCVE-2023-6268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- JSON Content Importer
- Fixed in
- 1.5.4
- What to do
- Update JSON Content Importer to 1.5.4 or newer.
Dec 26, 2023Quiz Maker: Does not escape generated URLs before outputting them in attributesCVE-2023-6166 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
- Product
- Quiz Maker
- Fixed in
- 6.4.9.5
- What to do
- Update Quiz Maker to 6.4.9.5 or newer.
Dec 26, 2023Quiz Maker: Does not adequately authorize the `ays_quiz_author_user_search` AJAX actionCVE-2023-6155 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.
- Product
- Quiz Maker
- Fixed in
- 6.4.9.5
- What to do
- Update Quiz Maker to 6.4.9.5 or newer.
Dec 26, 2023Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro: Does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version)CVE-2023-6114 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
- Product
- Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro
- Fixed in
- 1.5.7.1
- What to do
- Update Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro to 1.5.7.1 or newer.
Full record and what to do →NVD recorddrive.google.comwpscan.com
Dec 26, 2023Hotel Booking Lite: Does not validate file paths provided via user inputCVE-2023-5991 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
- Product
- Hotel Booking Lite
- Fixed in
- 4.8.5
- What to do
- Update Hotel Booking Lite to 4.8.5 or newer.
Dec 26, 2023BSK Forms Blacklist: Does not sanitise and escape some of its settingsCVE-2023-5980 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- BSK Forms Blacklist
- Fixed in
- 3.7
- What to do
- Update BSK Forms Blacklist to 3.7 or newer.
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Does not validate files to be uploadedCVE-2023-5931 · WordPress plugins & themes · reported by WPScanHigh 8.8
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.6.16
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.6.16 or newer.
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5674 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Mail Log: Does not properly validate file extensions uploading files to attach to emailsCVE-2023-5673 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Mail Log: Does not properly validate file path parametersCVE-2023-5672 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5645 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Mail Log: Does not correctly authorize its REST API endpointsCVE-2023-5644 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Sessions Time Monitoring Full Automatic: Does not sanitize the request URL or query parameters before using them in an SQL queryCVE-2023-5203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
- Product
- WP Sessions Time Monitoring Full Automatic
- Fixed in
- 1.0.9
- What to do
- Update WP Sessions Time Monitoring Full Automatic to 1.0.9 or newer.
Dec 21, 2023Keycloak's device authorization grant does not correctly validate the device code and client ID.CVE-2023-2585 · Other software · Red Hat · reported by Red HatLow 3.5
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
- Product
- Red Hat Single Sign-On 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 19, 2023 EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full coCVE-2023-6928 · Other software · EuroTel · reported by ics-cert@hq.dhs.govCritical 9.8
EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.
- Product
- ETL3100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
- Product
- SiteOrigin Widgets Bundle
- Fixed in
- 1.51.0
- What to do
- Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
- Product
- Swift Performance Lite
- Fixed in
- 2.3.6.15
- What to do
- Update Swift Performance Lite to 2.3.6.15 or newer.
Dec 18, 2023Theme My Login 2FA: Does not rate limit 2FA validation attemptsCVE-2023-6272 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
- Product
- Theme My Login 2FA
- Fixed in
- 1.2
- What to do
- Update Theme My Login 2FA to 1.2 or newer.
Dec 18, 2023IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perfCVE-2023-6222 · WordPress plugins & themes · reported by WPScanHigh 7.2
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
- Fixed in
- 3.4.2.1
- What to do
- Update the plugin to 3.4.2.1 or newer.
Full record and what to do →NVD recorddrive.google.comwpscan.com
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
- Product
- Slider
- Fixed in
- 3.5.12
- What to do
- Update Slider to 3.5.12 or newer.
Dec 18, 2023Quttera Web Malware Scanner: Doesn't restrict access to detailed scan logsCVE-2023-6065 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
- Product
- Quttera Web Malware Scanner
- Fixed in
- 3.4.2.1
- What to do
- Update Quttera Web Malware Scanner to 3.4.2.1 or newer.
Full record and what to do →NVD recorddrive.google.comwpscan.com
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
- Product
- SmartCrawl
- Fixed in
- 3.8.3
- What to do
- Update SmartCrawl to 3.8.3 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
- Product
- Product Catalog Mode For WooCommerce
- Fixed in
- 5.0.3
- What to do
- Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
- Fixed in
- 3.0
- What to do
- Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.CVE-2023-5236 · Other software · Red Hat · reported by Red HatMedium 4.4
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Product
- Red Hat Data Grid 8.4.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 18, 2023The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote cCVE-2023-32728 · Other software · Zabbix · reported by security@zabbix.comMedium 4.6
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comsupport.zabbix.com
Dec 18, 2023The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.CVE-2023-32726 · Other software · Zabbix · reported by security@zabbix.comLow 3.9
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Dec 15, 2023 When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the dataCVE-2023-33222 · Other software · IDEMIA · reported by a87f365f-9d39-4848-9b3a-58c7cae69cabMedium 6.8
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device
- Product
- SIGMA Lite & Lite +
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023 During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check.CVE-2023-33220 · Other software · IDEMIA · reported by a87f365f-9d39-4848-9b3a-58c7cae69cabCritical 9.1
During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device
- Product
- SIGMA Lite & Lite +
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023 The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations.CVE-2023-33219 · Other software · IDEMIA · reported by a87f365f-9d39-4848-9b3a-58c7cae69cabCritical 9.1
The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device
- Product
- SIGMA Lite & Lite +
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type.CVE-2023-48394 · Other software · Kaifa Technology · reported by twcert@cert.org.twHigh 8.8
Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
- Product
- WebITR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type.CVE-2023-48376 · Other software · SmartStar Software · reported by twcert@cert.org.twCritical 9.8
SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
- Product
- CWS Web-Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 14, 2023ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type.CVE-2023-48371 · Other software · ITPison · reported by twcert@cert.org.twCritical 9.8
ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
- Product
- OMICARD EDM 's SMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 14, 2023The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to acCVE-2023-45894 · Other software · Parallels · reported by MITRECritical 10
The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.
- Product
- Remote Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potentiaCVE-2023-50777 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins PaaSLane Estimate Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers CVE-2023-50773 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins Dingding JSON Pusher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/ConCVE-2023-50764 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.
- Product
- Jenkins Scriptler Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter.CVE-2023-47323 · Other software · Silverpeas · reported by MITREHigh 7.5
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
- Product
- Silverpeas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023 Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creatiCVE-2023-3517 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.5
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pentaho.comsupport.pentaho.com
Dec 11, 2023The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resCVE-2023-49577 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
- Product
- SAP HCM (SMART PAYE solution)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023EazyDocs: Does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX actionCVE-2023-6035 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
- Product
- EazyDocs
- Fixed in
- 2.3.4
- What to do
- Update EazyDocs to 2.3.4 or newer.
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Form Email
- Fixed in
- 1.3.44
- What to do
- Update Contact Form Email to 1.3.44 or newer.
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Not Login Hide (WPNLH)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2023File Manager: Does not restrict the file managers root directoryCVE-2023-5907 · WordPress plugins & themes · reported by WPScanMedium 6.5
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
- Product
- File Manager
- Fixed in
- 6.3
- What to do
- Update File Manager to 6.3 or newer.
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.8
- What to do
- Update WP Crowdfunding to 2.1.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.