Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,520 results · page 106 of 391
Oct 16, 2023Interactive Contact Form and Multi Step Form Builder: Does not sanitise and escape some parametersCVE-2023-4950 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
- Product
- Interactive Contact Form and Multi Step Form Builder
- Fixed in
- 3.4
- What to do
- Update Interactive Contact Form and Multi Step Form Builder to 3.4 or newer.
Oct 16, 2023WP Job Openings: Does not block listing the contents of the directories where it stores attachments to job applicationsCVE-2023-4933 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
- Product
- WP Job Openings
- Fixed in
- 3.4.3
- What to do
- Update WP Job Openings to 3.4.3 or newer.
Oct 16, 2023File Manager Pro: Does not adequately validate and escape some inputsCVE-2023-4862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 16, 2023Drag and Drop Multiple File Upload for WooCommerce: Does not filter all potentially dangerous file extensionsCVE-2023-4821 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.
- Product
- Drag and Drop Multiple File Upload for WooCommerce
- Fixed in
- 1.1.1
- What to do
- Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.1 or newer.
Oct 16, 2023PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape the media url field in postsCVE-2023-4820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.0.12
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.0.12 or newer.
Oct 16, 2023Shared Files: Does not return the right Content-Type header for the specified uploaded fileCVE-2023-4819 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.
- Product
- Shared Files
- Fixed in
- 1.7.6
- What to do
- Update Shared Files to 1.7.6 or newer.
Oct 16, 2023WordPress File Upload: Does not sanitise and escape some of its settingsCVE-2023-4811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress File Upload
- Fixed in
- 4.23.3
- What to do
- Update WordPress File Upload to 4.23.3 or newer.
Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tutor LMS
- Fixed in
- 2.3.0
- What to do
- Update Tutor LMS to 2.3.0 or newer.
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
- Product
- DoLogin Security
- Fixed in
- 3.7.1
- What to do
- Update DoLogin Security to 3.7.1 or newer.
Oct 16, 2023User Avatar: Does not properly sanitize and escape certain of its shortcodes attributesCVE-2023-4798 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
- Product
- User Avatar
- Fixed in
- 1.2.2
- What to do
- Update User Avatar to 1.2.2 or newer.
Oct 16, 2023Testimonial Slider Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Testimonial Slider Shortcode
- Fixed in
- 1.1.9
- What to do
- Update Testimonial Slider Shortcode to 1.1.9 or newer.
Oct 16, 2023Magee Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023Simple Posts Ticker: Does not sanitise and escape some of its settingsCVE-2023-4725 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.4
- What to do
- Update WordPress Online Booking and Scheduling to 22.4 or newer.
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled postsCVE-2023-4687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.7.7
- What to do
- Update Page Builder: Pagelayer to 1.7.7 or newer.
Oct 16, 2023Form Maker by 10Web: Does not validate signaturesCVE-2023-4666 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.20
- What to do
- Update Form Maker by 10Web to 1.15.20 or newer.
Oct 16, 2023Simple Posts Ticker: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4646 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023EventON: Does not sanitise and escape some of its settingsCVE-2023-4388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not escape the PHP_SELF server variableCVE-2023-4290 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.7
- What to do
- Update WP Matterport Shortcode to 2.1.7 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.8
- What to do
- Update WP Matterport Shortcode to 2.1.8 or newer.
Oct 16, 2023ActivityPub: Does not sanitize and escape some data from post contentCVE-2023-3746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023ActivityPub: Does not ensure that post contents to be displayed are public and belong to the pluginCVE-2023-3707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023ActivityPub: Does not ensure that post titles to be displayed are public and belong to the pluginCVE-2023-3706 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 16, 2023File Manager Pro: Does not properly check the CSRF nonce in the `fs_connector` AJAX actionCVE-2023-4827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
- Product
- File Manager Pro
- Fixed in
- 1.8
- What to do
- Update File Manager Pro to 1.8 or newer.
Oct 16, 2023Booking Calendar: Does not sanitize and escape some of its booking from dataCVE-2023-4620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators
- Product
- Booking Calendar
- Fixed in
- 9.7.3.1
- What to do
- Update Booking Calendar to 9.7.3.1 or newer.
Oct 15, 2023urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheCVE-2018-25091 · Other software · Python · reported by MITREMedium 6.1
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
- Product
- Urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023 The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.CVE-2023-43611 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privCVE-2023-42473 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.
- Product
- S/4HANA (Manage Withholding Tax Items)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source.CVE-2023-40310 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.
- Product
- SAP PowerDesigner Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability sCVE-2023-4497 · Other software · EFS Software · reported by cve-coordination@incibe.esMedium 6.1
Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability sCVE-2023-4496 · Other software · EFS Software · reported by cve-coordination@incibe.esMedium 6.1
Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability sCVE-2023-4495 · Other software · EFS Software · reported by cve-coordination@incibe.esMedium 6.1
Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit.CVE-2023-3153 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
- Product
- Fast Datapath for RHEL 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 3, 2023Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.CVE-2023-40830 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.
- Product
- ac6_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comreference1.example.com
Oct 3, 2023QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so.CVE-2023-4102 · Other software · IDM Sistemas QSige · reported by cve-coordination@incibe.esHigh 8.8
QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so.CVE-2023-4101 · Other software · IDM Sistemas QSige · reported by cve-coordination@incibe.esHigh 8.8
The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so.CVE-2023-4099 · Other software · QSige de IDM Sistemas · reported by cve-coordination@incibe.esHigh 7.6
The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure.CVE-2023-4098 · Other software · QSige de IDM Sistemas · reported by cve-coordination@incibe.esHigh 8.8
It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.
- Product
- QSige
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.CVE-2022-35908 · Other software · Cambiumnetworks · reported by MITREHigh 8.8
Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.
- Product
- Enterprise Wi-fi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.cambiumnetworks.comcambiumnetworks.com
Sep 28, 2023The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44166 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44164 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44163 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-43739 · Other software · Online Book Store Project · reported by help@fluidattacks.comCritical 9.8
The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Book Store Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 27, 2023Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps.CVE-2023-43660 · Other software · warp-tech · reported by GitHubMedium 4.8
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm.CVE-2023-0456 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
- Product
- Red Hat 3scale API Management Platform 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
- Product
- DoLogin Security
- Fixed in
- 3.7
- What to do
- Update DoLogin Security to 3.7 or newer.
Sep 25, 2023Translate WordPress with GTranslate: Does not sanitise and escape some of its settingsCVE-2023-4502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.4
- What to do
- Update Translate WordPress with GTranslate to 3.0.4 or newer.
Sep 25, 2023WP Job Portal: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-4490 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
- Product
- WP Job Portal
- Fixed in
- 2.0.6
- What to do
- Update WP Job Portal to 2.0.6 or newer.
Sep 25, 2023Locatoraid Store Locator: Does not sanitise and escape the lpr-search parameter before outputting it back in the pageCVE-2023-4476 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Locatoraid Store Locator
- Fixed in
- 3.9.24
- What to do
- Update Locatoraid Store Locator to 3.9.24 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.