Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,451 results · page 98 of 390
Feb 12, 2024SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an CVE-2024-24741 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.
- Product
- SAP Master Data Governance Material
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently eCVE-2024-22128 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation.
- Product
- SAP NetWeaver Business Client for HTML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Smart Manager
- Fixed in
- 8.28.0
- What to do
- Update Smart Manager to 8.28.0 or newer.
Feb 12, 2024MapPress Maps for: Does not sanitize and escape the map titleCVE-2024-0420 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
- Product
- MapPress Maps for
- Fixed in
- 2.88.15
- What to do
- Update MapPress Maps for to 2.88.15 or newer.
Feb 12, 2024GigPress: Does not sanitise and escape some of its settingsCVE-2023-7233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GigPress
- Affected
- up to 2.3.29
- What to do
- Affects up to 2.3.29. Update GigPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Popup Box: Does not sanitise and escape some of its settingsCVE-2023-6591 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Popup Box
- Fixed in
- 20.9.0
- What to do
- Update Popup Box to 20.9.0 or newer.
Feb 12, 2024Splashscreen: Does not have CSRF check in placeCVE-2023-6501 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Splashscreen
- Affected
- up to 0.20
- What to do
- Affects up to 0.20. Update Splashscreen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Feb 12, 2024lasTunes: Does not have CSRF check in some placesCVE-2023-6499 · WordPress plugins & themes · reported by WPScanMedium 5.4
The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- lasTunes
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update lasTunes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Popup Builder: Does not validate a parameter before making a request to itCVE-2023-6294 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
- Product
- Popup Builder
- Fixed in
- 4.2.6
- What to do
- Update Popup Builder to 4.2.6 or newer.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2024printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cCVE-2024-25741 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspinics.netlists.debian.org
Feb 8, 2024IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonCVE-2023-45187 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.
- Product
- Engineering Lifecycle Optimization - Publishing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 8, 2024IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or seCVE-2023-42016 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559.
- Product
- Sterling B2B Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 7, 2024IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easiCVE-2023-38369 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.
- Product
- Security Verify Access Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 6, 2024An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when quCVE-2024-23446 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Feb 5, 20243DPrint Lite: Does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX actionCVE-2021-4436 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
- Product
- 3DPrint Lite
- Fixed in
- 1.9.1.5
- What to do
- Update 3DPrint Lite to 1.9.1.5 or newer.
Feb 3, 2024The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template inCVE-2023-49950 · Other software · Logpoint · reported by MITREMedium 5.4
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comservicedesk.logpoint.com
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism.CVE-2023-50962 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using sessioCVE-2023-50941 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation. IBM X-Force ID: 275131.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.CVE-2023-50936 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 29, 2024EventON: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-7200 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON
- Fixed in
- 4.4.1
- What to do
- Update EventON to 4.4.1 or newer.
Jan 29, 2024Easy SVG Allow: Does not sanitize uploaded SVG filesCVE-2023-7089 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Easy SVG Allow
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy SVG Allow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024WP SOCIAL BOOKMARK MENU: Does not have CSRF check in placeCVE-2023-7074 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP SOCIAL BOOKMARK MENU
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP SOCIAL BOOKMARK MENU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Autotitle for: Does not have CSRF check in placeCVE-2023-6946 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Autotitle for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Autotitle for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Site Notes: Does not have CSRF checks in some of its functionalitiesCVE-2023-6633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
- Product
- Site Notes
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Site Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- TJ Shortcodes
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Jan 29, 2024WP Plugin Lister: Does not have CSRF check in some placesCVE-2023-6503 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Plugin Lister
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Plugin Lister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Custom User CSS: Does not have CSRF check in placeCVE-2023-6391 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Custom User CSS
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Custom User CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WordPress Users
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 29, 2024Woostify Sites Library: Does not have authorisation in an AJAX actionCVE-2023-6279 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
- Product
- Woostify Sites Library
- Fixed in
- 1.4.8
- What to do
- Update Woostify Sites Library to 1.4.8 or newer.
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Fixed in
- 2.2.25
- What to do
- Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Restrict Usernames Emails Characters
- Fixed in
- 3.1.4
- What to do
- Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Wp-Adv-Quiz
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Wp-Adv-Quiz
- Fixed in
- 1.0.3
- What to do
- Update Wp-Adv-Quiz to 1.0.3 or newer.
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.0
- What to do
- Update Page Builder: Pagelayer to 1.8.0 or newer.
Jan 25, 2024IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.phCVE-2023-6282 · Other software · IceHrm · reported by cve-coordination@incibe.esMedium 5.4
IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim's browser.
- Product
- IceHrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force CVE-2023-33759 · Other software · Splicecom · reported by MITRECritical 9.8
SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force attack.
- Product
- Maximiser Soft PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argumCVE-2024-23904 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
- Product
- Jenkins Log Command Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 24, 2024Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with CVE-2024-23900 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
- Product
- Jenkins Matrix Project Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 24, 2024Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file paCVE-2024-23899 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.
- Product
- Jenkins Git server Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 24, 2024Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WCVE-2024-23898 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 22, 2024In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data.CVE-2024-23678 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.5
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Jan 22, 2024Meris: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-7194 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Meris
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Meris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2024EventON-RSVP: Does not sanitise and escape some parameters before outputting it back in the pageCVE-2023-7170 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON-RSVP
- Fixed in
- 2.9.5
- What to do
- Update EventON-RSVP to 2.9.5 or newer.
Jan 22, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2023-6626 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024Product Enquiry for WooCommerce: Does not have a CSRF check in placeCVE-2023-6625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Review Slider
- Fixed in
- 13.0
- What to do
- Update WP Review Slider to 13.0 or newer.
Jan 22, 2024WP User Profile Avatar: Does not properly check for authorisationCVE-2023-6384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
- Product
- WP User Profile Avatar
- Fixed in
- 1.0.1
- What to do
- Update WP User Profile Avatar to 1.0.1 or newer.
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- SEOPress
- Fixed in
- 7.3
- What to do
- Update SEOPress to 7.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.