Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,451 results · page 103 of 390
Nov 27, 202310Web Booster: Does not validate the option name given to some AJAX actionsCVE-2023-5559 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
- Product
- 10Web Booster
- Fixed in
- 2.24.18
- What to do
- Update 10Web Booster to 2.24.18 or newer.
Nov 27, 2023The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSSCVE-2023-5325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
- Product
- Woocommerce Vietnam Checkout
- Fixed in
- 2.0.6
- What to do
- Update Woocommerce Vietnam Checkout to 2.0.6 or newer.
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.5
- What to do
- Update WordPress Online Booking and Scheduling to 22.5 or newer.
Nov 27, 2023kk Star Ratings: Does not implement atomic operationsCVE-2023-4642 · WordPress plugins & themes · reported by WPScanMedium 5.9
The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition.
- Product
- kk Star Ratings
- Fixed in
- 5.4.6
- What to do
- Update kk Star Ratings to 5.4.6 or newer.
Nov 27, 2023Mmm Simple File List: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4514 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Mmm Simple File List
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023Mmm Simple File List: Does not validate the generated path to list files fromCVE-2023-4297 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
- Product
- Mmm Simple File List
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- gAppointments
- Affected
- up to 1.9.5.1
- What to do
- Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023WP Hotel Booking: Does not have proper authorisationCVE-2023-5799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them
- Product
- WP Hotel Booking
- Fixed in
- 2.0.8
- What to do
- Update WP Hotel Booking to 2.0.8 or newer.
Nov 20, 2023WP Hotel Booking: Does not have authorisation and CSRF checksCVE-2023-5652 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
- Product
- WP Hotel Booking
- Fixed in
- 2.0.8
- What to do
- Update WP Hotel Booking to 2.0.8 or newer.
Nov 20, 2023WP Hotel Booking: Does not have authorisation and CSRF checksCVE-2023-5651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
- Product
- WP Hotel Booking
- Fixed in
- 2.0.8
- What to do
- Update WP Hotel Booking to 2.0.8 or newer.
Nov 20, 2023The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauCVE-2023-5640 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddevl00p.github.iowpscan.com
Nov 20, 2023Seraphinite Accelerator: Does not validate the URL to redirect any authenticated user toCVE-2023-5610 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
- Product
- Seraphinite Accelerator
- Fixed in
- 2.2.29
- What to do
- Update Seraphinite Accelerator to 2.2.29 or newer.
Nov 20, 2023Seraphinite Accelerator: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5609 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Seraphinite Accelerator
- Fixed in
- 2.2.29
- What to do
- Update Seraphinite Accelerator to 2.2.29 or newer.
Nov 20, 2023myStickymenu: Does not adequately authorize some ajax callsCVE-2023-5509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
- Product
- myStickymenu
- Fixed in
- 2.6.5
- What to do
- Update myStickymenu to 2.6.5 or newer.
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Popup box
- Fixed in
- 3.7.9
- What to do
- Update Popup box to 3.7.9 or newer.
Nov 20, 2023Bonus for Woo: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-5140 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Bonus for Woo
- Fixed in
- 5.8.3
- What to do
- Update Bonus for Woo to 5.8.3 or newer.
Nov 20, 2023Forminator: Does not properly sanitize the redirect-url field in the form submission settingsCVE-2023-5119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Forminator
- Fixed in
- 1.27.0
- What to do
- Update Forminator to 1.27.0 or newer.
Nov 20, 2023PubyDoc: Does not sanitise and escape some of its settingsCVE-2023-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- PubyDoc
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update PubyDoc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- What to do
- Update the plugin to the newest version.
Nov 20, 2023WP Post Popup: Does not sanitise and escape some of its inputsCVE-2023-4808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Post Popup
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update WP Post Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023Magic Embeds: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Magic Embeds
- Fixed in
- 3.1.2
- What to do
- Update Magic Embeds to 3.1.2 or newer.
Nov 16, 2023In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that usersCVE-2023-46214 · Other software · Splunk · reported by prodsec@splunk.comHigh 8
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Nov 15, 2023A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain.CVE-2023-5720 · Other software · Quarkus · reported by Red HatHigh 7.7
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Product
- Quarkus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 14, 2023GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication.CVE-2023-45878 · Other software · Gibbonedu · reported by MITRECritical 9.8
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Nov 13, 2023SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder.CVE-2023-31403 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.
- Product
- SAP Business One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2023 IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2023-38363 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 9, 2023On Windows, The IsLocal function does not correctly detect reserved device names in some cases.CVE-2023-45284 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The filepath package does not recognize paths with a \??\ prefix as special.CVE-2023-45283 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not coCVE-2023-5941 · Other software · FreeBSD · reported by secteam@freebsd.orgCritical 9.8
In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error. Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur. Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.freebsd.orgsecurity.netapp.com
Nov 7, 2023Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments.CVE-2023-46851 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
- Product
- Apache Allura
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordallura.apache.orglists.apache.org
Nov 6, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-5605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.9.1
- What to do
- Update URL Shortify to 1.7.9.1 or newer.
Nov 6, 2023WooCommerce Ninja Forms Product Add-ons: Does not validate the file to be uploadedCVE-2023-5601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
- Product
- WooCommerce Ninja Forms Product Add-ons
- Fixed in
- 1.7.1
- What to do
- Update WooCommerce Ninja Forms Product Add-ons to 1.7.1 or newer.
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.34
- What to do
- Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD recordninjaforms.comwpscan.com
Nov 6, 2023Templately: Does not properly authorize the `saved-templates/delete` REST API callCVE-2023-5454 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
- Product
- Templately
- Fixed in
- 2.2.6
- What to do
- Update Templately to 2.2.6 or newer.
Nov 6, 2023Awesome Support: Does not sanitize file pathsCVE-2023-5355 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Nov 6, 2023Awesome Support: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Nov 6, 2023Awesome Support: Does not correctly authorize the wpas_edit_reply functionCVE-2023-5352 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Nov 6, 2023User Registration: Does not sanitize and escape some of its settingsCVE-2023-5228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- User Registration
- Fixed in
- 3.0.4.2
- What to do
- Update User Registration to 3.0.4.2 or newer.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Nov 6, 2023History Log by click5: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5082 · WordPress plugins & themes · reported by WPScanHigh 7.2
The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.
- Product
- History Log by click5
- Fixed in
- 1.0.13
- What to do
- Update History Log by click5 to 1.0.13 or newer.
Nov 6, 2023Front End PM: Does not block listing the contents of the directories where it stores attachments to private messagesCVE-2023-4930 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
- Product
- Front End PM
- Fixed in
- 11.4.3
- What to do
- Update Front End PM to 11.4.3 or newer.
Nov 6, 2023Simple Table Manager: Does not sanitise and escape some of its settingsCVE-2023-4858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Table Manager
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Simple Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2023Responsive Pricing Table: Does not sanitise and escape some of its settingsCVE-2023-4810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Pricing Table
- Fixed in
- 5.1.8
- What to do
- Update Responsive Pricing Table to 5.1.8 or newer.
Full record and what to do →NVD recordportswigger.netwpscan.com
Nov 6, 2023The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the CaptCVE-2023-5964 · Other software · 1E · reported by security@1e.comCritical 9.9
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients. To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.1e.comteamviewer.com
Nov 6, 2023The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameterCVE-2023-45163 · Other software · 1E · reported by security@1e.comCritical 9.9
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-CommandLinePing instruction to v18.1 by uploading it through the 1E Platform instruction upload UI
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.1e.comteamviewer.com
Nov 6, 2023The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, CVE-2023-45161 · Other software · 1E · reported by security@1e.comCritical 9.9
The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.1e.comteamviewer.com
Nov 5, 2023PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file naCVE-2023-47271 · Other software · SFU · reported by MITREMedium 5.3
PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
- Product
- PKP Web Application Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 3, 2023Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulneraCVE-2023-41354 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twMedium 4
Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulnerability by sending a crafted package, resulting in partially sensitive information exposed to an actor.
- Product
- NOKIA G-040W-Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 2, 2023bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackerCVE-2017-7252 · Other software · Botan Project · reported by MITREHigh 7.5
bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.
- Product
- Botan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbotan.randombit.netbugzilla.suse.com
Nov 2, 2023NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricCVE-2023-31019 · Other software · nvidia · reported by psirt@nvidia.comHigh 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client's secure context.
- Product
- NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.