Latest vulnerabilities of Tuesday, October 31, 2023

Latest vulnerabilities of Tuesday, October 31, 2023
https://www.securitricks.com/content/images/size/w600/format/webp/2023/12/VULNERABILITIES-REPORTS-LOGO.png
{{titre}}

Last update performed on 10/31/2023 at 11:57:02 PM

(5) CRITICAL VULNERABILITIES [9.0, 10.0]

Source : progress.com

Vulnerability ID : CVE-2023-40050

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

CVE ID : CVE-2023-40050
Source : security@progress.com
CVSS Score : 9.9

References :
https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050 | source : security@progress.com
https://docs.chef.io/automate/profiles/ | source : security@progress.com
https://docs.chef.io/release_notes_automate/ | source : security@progress.com

Vulnerability : CWE-434
Vulnerability : CWE-94


Source : mitre.org

Vulnerability ID : CVE-2023-36263

First published on : 31-10-2023 05:15:58
Last modified on : 31-10-2023 12:58:31

Description :
Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

CVE ID : CVE-2023-36263
Source : cve@mitre.org
CVSS Score : 9.8

References :
https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html | source : cve@mitre.org


Source : github.com

Vulnerability ID : CVE-2023-46249

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

CVE ID : CVE-2023-46249
Source : security-advisories@github.com
CVSS Score : 9.6

References :
https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0 | source : security-advisories@github.com
https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc | source : security-advisories@github.com
https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2 | source : security-advisories@github.com
https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4 | source : security-advisories@github.com
https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w | source : security-advisories@github.com

Vulnerability : CWE-287


Vulnerability ID : CVE-2023-46248

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded.

CVE ID : CVE-2023-46248
Source : security-advisories@github.com
CVSS Score : 9.0

References :
https://github.com/sourcegraph/cody/pull/1414 | source : security-advisories@github.com
https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq | source : security-advisories@github.com

Vulnerability : CWE-15


Source : atlassian.com

Vulnerability ID : CVE-2023-22518

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVE ID : CVE-2023-22518
Source : security@atlassian.com
CVSS Score : 9.1

References :
https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907 | source : security@atlassian.com
https://jira.atlassian.com/browse/CONFSERVER-93142 | source : security@atlassian.com


(33) HIGH VULNERABILITIES [7.0, 8.9]

Source : github.com

Vulnerability ID : CVE-2023-46723

First published on : 31-10-2023 16:15:10
Last modified on : 31-10-2023 17:07:44

Description :
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.

CVE ID : CVE-2023-46723
Source : security-advisories@github.com
CVSS Score : 8.9

References :
https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh | source : security-advisories@github.com

Vulnerability : CWE-538


Vulnerability ID : CVE-2023-46236

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

CVE ID : CVE-2023-46236
Source : security-advisories@github.com
CVSS Score : 8.6

References :
https://github.com/FOGProject/fogproject/commit/9125f35ff649a3e7fd7771b1c8e5add3c726f763 | source : security-advisories@github.com
https://github.com/FOGProject/fogproject/security/advisories/GHSA-8qg4-9363-873h | source : security-advisories@github.com

Vulnerability : CWE-918


Vulnerability ID : CVE-2023-46129

First published on : 31-10-2023 00:15:09
Last modified on : 31-10-2023 18:15:08

Description :
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

CVE ID : CVE-2023-46129
Source : security-advisories@github.com
CVSS Score : 7.5

References :
http://www.openwall.com/lists/oss-security/2023/10/31/1 | source : security-advisories@github.com
https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 | source : security-advisories@github.com

Vulnerability : CWE-321
Vulnerability : CWE-325


Vulnerability ID : CVE-2023-46239

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

CVE ID : CVE-2023-46239
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617 | source : security-advisories@github.com
https://github.com/quic-go/quic-go/releases/tag/v0.37.3 | source : security-advisories@github.com
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h | source : security-advisories@github.com

Vulnerability : CWE-248


Vulnerability ID : CVE-2023-46240

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.

CVE ID : CVE-2023-46240
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://codeigniter4.github.io/userguide/general/errors.html#error-reporting | source : security-advisories@github.com
https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563 | source : security-advisories@github.com
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj | source : security-advisories@github.com

Vulnerability : CWE-209


Vulnerability ID : CVE-2023-46245

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
Kimai is a web-based multi-user time-tracking application. Versions 2.1.0 and prior are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. As of time of publication, no patches or known workarounds are available.

CVE ID : CVE-2023-46245
Source : security-advisories@github.com
CVSS Score : 7.2

References :
https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw | source : security-advisories@github.com

Vulnerability : CWE-1336


Source : wordfence.com

Vulnerability ID : CVE-2023-5412

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:31

Description :
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5412
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/image-horizontal-reel-scroll-slideshow/trunk/image-horizontal-reel-scroll-slideshow.php?rev=2827121#L176 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985331/image-horizontal-reel-scroll-slideshow#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/08fb698f-c87c-4200-85fe-3fe72745633e?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5428

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:31

Description :
The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5428
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/image-vertical-reel-scroll-slideshow/trunk/image-vertical-reel-scroll-slideshow.php?rev=2827122#L273 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985333/image-vertical-reel-scroll-slideshow#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/01d31d8a-4459-488a-9cbe-92761faa58b4?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5429

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:31

Description :
The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5429
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/information-reel/trunk/information-reel.php?rev=2827123#L134 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985373/information-reel#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/64db63e5-ff76-494a-be4f-d820f0cc9ab0?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5430

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:31

Description :
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5430
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/jquery-news-ticker/trunk/jquery-news-ticker.php?rev=2827068#L92 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985559/jquery-news-ticker#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7f8739-7f40-40a7-952e-002ea3b82ac7?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5431

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:31

Description :
The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5431
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/left-right-image-slideshow-gallery/trunk/left-right-image-slideshow-gallery.php?rev=2827127#L211 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985417/left-right-image-slideshow-gallery#file0 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/69902627-ce79-4a43-8949-43db6a9cc0dd?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5433

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5433
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/message-ticker/trunk/message-ticker.php?rev=2827131#L142 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985499/message-ticker#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b1fa88-2fc6-41af-bd39-12af92dc6533?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5434

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5434
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/superb-slideshow-gallery/trunk/superb-slideshow-gallery.php?rev=2827170#L127 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985501/superb-slideshow-gallery#file2 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3a12945d-a67c-4a19-a4e7-f65f5f2a21bb?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5435

First published on : 31-10-2023 09:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5435
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/up-down-image-slideshow-gallery/trunk/up-down-image-slideshow-gallery.php?rev=2827173#L208 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985497/up-down-image-slideshow-gallery#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0b72cf6f-4924-4fa5-8e1a-4054dfe73be0?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5436

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5436
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/vertical-marquee-plugin/trunk/vertical-marquee-plugin.php?rev=2827080#L170 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985561/vertical-marquee-plugin#file2 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd90d9c0-0cab-4fd3-b016-106032f300f7?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5437

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5437
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/wp-fade-in-text-news/trunk/wp-fade-in-text-news.php?rev=2827202#L236 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985398/wp-fade-in-text-news#file2 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b4accf10-710e-4cba-8d61-04e422324f9d?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5438

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5438
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/wp-image-slideshow/trunk/wp-image-slideshow.php?rev=2827205#L189 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985394/wp-image-slideshow#file2 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e24383b-5b0f-4114-908b-4c2778632f73?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5439

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5439
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/wp-photo-text-slider-50/trunk/wp-photo-text-slider-50.php?rev=2827206#L196 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985502/wp-photo-text-slider-50#file1 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/515502b5-c344-4855-aff1-57833233c5d2?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5464

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2023-5464
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/jquery-accordion-slideshow/trunk/jquery-accordion-slideshow.php?rev=2827053#L177 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/2985511/jquery-accordion-slideshow#file0 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0531ca34-5d7b-4071-a1aa-934f14b87728?source=cve | source : security@wordfence.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-5099

First published on : 31-10-2023 12:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other โ€œsafeโ€ file types can be uploaded and included.

CVE ID : CVE-2023-5099
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/changeset/2985200/hk-filter-and-search | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2b4055-8cbd-49b7-bb0b-eddef85060fc?source=cve | source : security@wordfence.com

Vulnerability : CWE-98


Source : progress.com

Vulnerability ID : CVE-2023-42658

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 16:15:09

Description :
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.

CVE ID : CVE-2023-42658
Source : security@progress.com
CVSS Score : 8.8

References :
https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Inspec-CVE-2023-42658 | source : security@progress.com
https://docs.chef.io/inspec/cli/ | source : security@progress.com
https://docs.chef.io/release_notes_inspec/ | source : security@progress.com

Vulnerability : CWE-917
Vulnerability : CWE-94


Source : vmware.com

Vulnerability ID : CVE-2023-20886

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

CVE ID : CVE-2023-20886
Source : security@vmware.com
CVSS Score : 8.8

References :
https://www.vmware.com/security/advisories/VMSA-2023-0025.html | source : security@vmware.com

Vulnerability : CWE-601


Source : liggitt.net

Vulnerability ID : CVE-2023-3676

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVE ID : CVE-2023-3676
Source : jordan@liggitt.net
CVSS Score : 8.8

References :
https://github.com/kubernetes/kubernetes/issues/119339 | source : jordan@liggitt.net
https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc | source : jordan@liggitt.net

Vulnerability : CWE-20


Vulnerability ID : CVE-2023-3955

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVE ID : CVE-2023-3955
Source : jordan@liggitt.net
CVSS Score : 8.8

References :
https://github.com/kubernetes/kubernetes/issues/119595 | source : jordan@liggitt.net
https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E | source : jordan@liggitt.net

Vulnerability : CWE-20


Source : cert-in.org.in

Vulnerability ID : CVE-2022-3007

First published on : 31-10-2023 12:15:08
Last modified on : 31-10-2023 12:58:27

Description :
** UNSUPPPORTED WHEN ASSIGNED ** The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.

CVE ID : CVE-2022-3007
Source : vdisclose@cert-in.org.in
CVSS Score : 8.1

References :
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333 | source : vdisclose@cert-in.org.in

Vulnerability : CWE-862


Source : mitre.org

Vulnerability ID : CVE-2023-38994

First published on : 31-10-2023 12:15:08
Last modified on : 31-10-2023 12:58:27

Description :
An issue in Univention UCS v.5.0 allows a local attacker to execute arbitrary code and gain privileges via the check_univention_joinstatus function.

CVE ID : CVE-2023-38994
Source : cve@mitre.org
CVSS Score : 7.9

References :
https://forge.univention.org/bugzilla/show_bug.cgi?id=56324 | source : cve@mitre.org
https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0 | source : cve@mitre.org
https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network | source : cve@mitre.org


Source : google.com

Vulnerability ID : CVE-2023-37243

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Package.Availability.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.

CVE ID : CVE-2023-37243
Source : cve-coordination@google.com
CVSS Score : 7.8

References :
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0010.md | source : cve-coordination@google.com

Vulnerability : CWE-379


Source : huntr.dev

Vulnerability ID : CVE-2023-5865

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.

CVE ID : CVE-2023-5865
Source : security@huntr.dev
CVSS Score : 7.6

References :
https://github.com/thorsten/phpmyfaq/commit/5f43786f52c3d517e7665abd25d534e180e08dc5 | source : security@huntr.dev
https://huntr.com/bounties/4c4b7395-d9fd-4ca0-98d7-2e20c1249aff | source : security@huntr.dev

Vulnerability : CWE-613


Vulnerability ID : CVE-2023-5863

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.

CVE ID : CVE-2023-5863
Source : security@huntr.dev
CVSS Score : 7.4

References :
https://github.com/thorsten/phpmyfaq/commit/97e813dcd2022bd10a8770569a8b02591716365f | source : security@huntr.dev
https://huntr.com/bounties/fbfd4e84-61fb-4063-8f11-15877b8c1f6f | source : security@huntr.dev

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5864

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.

CVE ID : CVE-2023-5864
Source : security@huntr.dev
CVSS Score : 7.4

References :
https://github.com/thorsten/phpmyfaq/commit/b3e5a053b59dcc072d76a55d6ce0311ea30174fa | source : security@huntr.dev
https://huntr.com/bounties/e4b0e8f4-5e06-49d1-832f-5756573623ad | source : security@huntr.dev

Vulnerability : CWE-79


Source : patchstack.com

Vulnerability ID : CVE-2023-46312

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zaytech Smart Online Order for Clover plugin <= 1.5.4 versions.

CVE ID : CVE-2023-46312
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/clover-online-orders/wordpress-smart-online-order-for-clover-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-46313

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.4 versions.

CVE ID : CVE-2023-46313
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/zotpress/wordpress-zotpress-plugin-7-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-46622

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza โ€“ A Restaurant Plugin plugin <= 3.18.2 versions.

CVE ID : CVE-2023-46622
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/wppizza/wordpress-wppizza-plugin-3-18-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79


(23) MEDIUM VULNERABILITIES [4.0, 6.9]

Source : patchstack.com

Vulnerability ID : CVE-2023-25045

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:18

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.

CVE ID : CVE-2023-25045
Source : audit@patchstack.com
CVSS Score : 6.7

References :
https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-9-9-3-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-46210

First published on : 31-10-2023 08:15:07
Last modified on : 31-10-2023 12:58:31

Description :
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions.

CVE ID : CVE-2023-46210
Source : audit@patchstack.com
CVSS Score : 5.9

References :
https://patchstack.com/database/vulnerability/wc-captcha/wordpress-wc-captcha-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-40681

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions.

CVE ID : CVE-2023-40681
Source : audit@patchstack.com
CVSS Score : 5.9

References :
https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-11-10-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79


Source : huntr.dev

Vulnerability ID : CVE-2023-5861

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.

CVE ID : CVE-2023-5861
Source : security@huntr.dev
CVSS Score : 6.4

References :
https://github.com/microweber/microweber/commit/6ed7ebf1631dd8f0780caa4151a5538f3b227d26 | source : security@huntr.dev
https://huntr.com/bounties/7baecef8-6c59-42fc-bced-886c4929e220 | source : security@huntr.dev

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5866

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:31

Description :
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.

CVE ID : CVE-2023-5866
Source : security@huntr.dev
CVSS Score : 6.3

References :
https://github.com/thorsten/phpmyfaq/commit/fdacff14acd5e69841068f0e32b59e2d1b1d0d55 | source : security@huntr.dev
https://huntr.com/bounties/ec44bcba-ae7f-497a-851e-8165ecf56945 | source : security@huntr.dev

Vulnerability : CWE-614


Vulnerability ID : CVE-2023-5862

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
Missing Authorization in GitHub repository hamza417/inure prior to Build95.

CVE ID : CVE-2023-5862
Source : security@huntr.dev
CVSS Score : 5.1

References :
https://github.com/hamza417/inure/commit/52b8c0bae36f129a5be05e377d7391afc3629df6 | source : security@huntr.dev
https://huntr.com/bounties/0e517db6-d8ba-4cb9-9339-7991dda52e6d | source : security@huntr.dev

Vulnerability : CWE-862


Vulnerability ID : CVE-2023-5867

First published on : 31-10-2023 01:15:08
Last modified on : 31-10-2023 12:58:31

Description :
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.

CVE ID : CVE-2023-5867
Source : security@huntr.dev
CVSS Score : 4.6

References :
https://github.com/thorsten/phpmyfaq/commit/5310cb8c37dc3a5c5aead0898690b14705c433d3 | source : security@huntr.dev
https://huntr.com/bounties/5c09b32e-a041-4a1e-a277-eb3e80967df0 | source : security@huntr.dev

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5873

First published on : 31-10-2023 09:15:09
Last modified on : 31-10-2023 12:58:27

Description :
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.

CVE ID : CVE-2023-5873
Source : security@huntr.dev
CVSS Score : 4.0

References :
https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c | source : security@huntr.dev
https://huntr.com/bounties/701cfc30-22a1-4c4b-9b2f-885c77c290ce | source : security@huntr.dev

Vulnerability : CWE-79


Source : wordfence.com

Vulnerability ID : CVE-2023-5073

First published on : 31-10-2023 12:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2023-5073
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/browser/iframe-forms/trunk/iframe-forms.php#L29 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/818de7f7-913a-4ade-927e-bba281b4709a?source=cve | source : security@wordfence.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5116

First published on : 31-10-2023 13:15:09
Last modified on : 31-10-2023 14:23:18

Description :
The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2023-5116
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/browser/ipushpull/trunk/public/class-ipushpull-public.php#L113 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ab856722-e954-49de-a93f-46664da6e3e8?source=cve | source : security@wordfence.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5114

First published on : 31-10-2023 12:15:08
Last modified on : 31-10-2023 12:58:27

Description :
The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2023-5114
Source : security@wordfence.com
CVSS Score : 5.4

References :
https://plugins.trac.wordpress.org/browser/idbbee/trunk/idbbee.php#L34 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac763936-7147-4100-8a46-4c6d2f2224b4?source=cve | source : security@wordfence.com

Vulnerability : CWE-79


Source : github.com

Vulnerability ID : CVE-2023-46722

First published on : 31-10-2023 16:15:10
Last modified on : 31-10-2023 17:07:44

Description :
The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.

CVE ID : CVE-2023-46722
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9 | source : security-advisories@github.com
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42f | source : security-advisories@github.com
https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c | source : security-advisories@github.com

Vulnerability : CWE-79
Vulnerability : CWE-80


Vulnerability ID : CVE-2023-46237

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.

CVE ID : CVE-2023-46237
Source : security-advisories@github.com
CVSS Score : 5.8

References :
https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b | source : security-advisories@github.com
https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2 | source : security-advisories@github.com

Vulnerability : CWE-22


Vulnerability ID : CVE-2023-46235

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.

CVE ID : CVE-2023-46235
Source : security-advisories@github.com
CVSS Score : 5.4

References :
https://github.com/FOGProject/fogproject/commit/2e2421f19620669b9930f72fb73a8dbc5efe4980 | source : security-advisories@github.com
https://github.com/FOGProject/fogproject/security/advisories/GHSA-cvf7-7mvq-5694 | source : security-advisories@github.com

Vulnerability : CWE-79
Vulnerability : CWE-80


Vulnerability ID : CVE-2023-43796

First published on : 31-10-2023 17:15:23
Last modified on : 31-10-2023 17:15:23

Description :
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

CVE ID : CVE-2023-43796
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458f | source : security-advisories@github.com
https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575 | source : security-advisories@github.com

Vulnerability : CWE-200


Vulnerability ID : CVE-2023-46250

First published on : 31-10-2023 16:15:09
Last modified on : 31-10-2023 17:07:44

Description :
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.

CVE ID : CVE-2023-46250
Source : security-advisories@github.com
CVSS Score : 5.1

References :
https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d | source : security-advisories@github.com
https://github.com/py-pdf/pypdf/pull/2264 | source : security-advisories@github.com
https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f | source : security-advisories@github.com

Vulnerability : CWE-835


Vulnerability ID : CVE-2023-46139

First published on : 31-10-2023 00:15:10
Last modified on : 31-10-2023 12:58:37

Description :
KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps.

CVE ID : CVE-2023-46139
Source : security-advisories@github.com
CVSS Score : 5.0

References :
http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770 | source : security-advisories@github.com
http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783 | source : security-advisories@github.com
https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl | source : security-advisories@github.com
https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L179C32-L179C32 | source : security-advisories@github.com
https://github.com/tiann/KernelSU/blob/344c08bb79ba12b692016750cda363f9f3500182/kernel/apk_sign.c#L188 | source : security-advisories@github.com
https://github.com/tiann/KernelSU/commit/d24813b2c3738f2f9bd762932141cadd948c354f | source : security-advisories@github.com
https://github.com/tiann/KernelSU/security/advisories/GHSA-86cp-3prf-pwqq | source : security-advisories@github.com

Vulnerability : CWE-863


Vulnerability ID : CVE-2023-46256

First published on : 31-10-2023 16:15:10
Last modified on : 31-10-2023 17:07:44

Description :
PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of `parserbuf_index` value checking. A malfunction of the sensor device can cause a heap buffer overflow with leading unexpected drone behavior. Malicious applications can exploit the vulnerability even if device sensor malfunction does not occur. Up to the maximum value of an `unsigned int`, bytes sized data can be written to the heap memory area. As of time of publication, no fixed version is available.

CVE ID : CVE-2023-46256
Source : security-advisories@github.com
CVSS Score : 4.4

References :
https://github.com/PX4/PX4-Autopilot/blob/main/src/drivers/distance_sensor/lightware_laser_serial/parser.cpp#L87 | source : security-advisories@github.com
https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-5hvv-q2r5-rppw | source : security-advisories@github.com

Vulnerability : CWE-120
Vulnerability : CWE-122


Vulnerability ID : CVE-2023-46255

First published on : 31-10-2023 16:15:10
Last modified on : 31-10-2023 17:07:44

Description :
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0 patches this issue.

CVE ID : CVE-2023-46255
Source : security-advisories@github.com
CVSS Score : 4.2

References :
https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8 | source : security-advisories@github.com
https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2 | source : security-advisories@github.com

Vulnerability : CWE-532


Source : fluidattacks.com

Vulnerability ID : CVE-2023-44484

First published on : 31-10-2023 22:15:08
Last modified on : 31-10-2023 22:15:08

Description :
Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.

CVE ID : CVE-2023-44484
Source : help@fluidattacks.com
CVSS Score : 6.1

References :
https://fluidattacks.com/advisories/carpenter/ | source : help@fluidattacks.com
https://projectworlds.in/ | source : help@fluidattacks.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-44485

First published on : 31-10-2023 22:15:08
Last modified on : 31-10-2023 22:15:08

Description :
Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'lastName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.

CVE ID : CVE-2023-44485
Source : help@fluidattacks.com
CVSS Score : 6.1

References :
https://fluidattacks.com/advisories/carpenter/ | source : help@fluidattacks.com
https://projectworlds.in/ | source : help@fluidattacks.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-44486

First published on : 31-10-2023 22:15:08
Last modified on : 31-10-2023 22:15:08

Description :
Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'address' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.

CVE ID : CVE-2023-44486
Source : help@fluidattacks.com
CVSS Score : 6.1

References :
https://fluidattacks.com/advisories/carpenter/ | source : help@fluidattacks.com
https://projectworlds.in/ | source : help@fluidattacks.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5306

First published on : 31-10-2023 22:15:08
Last modified on : 31-10-2023 22:15:08

Description :
Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'city' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.

CVE ID : CVE-2023-5306
Source : help@fluidattacks.com
CVSS Score : 6.1

References :
https://fluidattacks.com/advisories/carpenter/ | source : help@fluidattacks.com
https://projectworlds.in/ | source : help@fluidattacks.com

Vulnerability : CWE-79


(1) LOW VULNERABILITIES [0.1, 3.9]

Source : github.com

Vulnerability ID : CVE-2023-46138

First published on : 31-10-2023 00:15:10
Last modified on : 31-10-2023 12:58:37

Description :
JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the domain `mycompany.com` has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to `example.com`. Those who cannot upgrade may change the default email domain to `example.com` manually.

CVE ID : CVE-2023-46138
Source : security-advisories@github.com
CVSS Score : 3.7

References :
https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88 | source : security-advisories@github.com
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-9mrc-75cv-46cq | source : security-advisories@github.com

Vulnerability : CWE-640


(56) NO SCORE VULNERABILITIES [0.0, 0.0]

Source : mitre.org

Vulnerability ID : CVE-2023-31794

First published on : 31-10-2023 01:15:07
Last modified on : 31-10-2023 12:58:37

Description :
MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

CVE ID : CVE-2023-31794
Source : cve@mitre.org
CVSS Score : /

References :
https://bugs.ghostscript.com/show_bug.cgi?id=706506 | source : cve@mitre.org
https://gist.github.com/spookhorror/c770d118767b1b0d89fdfe2845169d06 | source : cve@mitre.org
https://git.ghostscript.com/?p=mupdf.git;h=c0015401693b58e2deb5d75c39f27bc1216e47c6 | source : cve@mitre.org


Vulnerability ID : CVE-2023-45899

First published on : 31-10-2023 02:15:07
Last modified on : 31-10-2023 12:58:31

Description :
An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call.

CVE ID : CVE-2023-45899
Source : cve@mitre.org
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2023/10/26/superuser.html | source : cve@mitre.org


Vulnerability ID : CVE-2023-46040

First published on : 31-10-2023 02:15:08
Last modified on : 31-10-2023 12:58:31

Description :
Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function.

CVE ID : CVE-2023-46040
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/Num-Nine/CVE/wiki/GetSimplecms-exists-to-store-xss | source : cve@mitre.org


Vulnerability ID : CVE-2015-20110

First published on : 31-10-2023 03:15:07
Last modified on : 31-10-2023 12:58:31

Description :
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.

CVE ID : CVE-2015-20110
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc | source : cve@mitre.org
https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25 | source : cve@mitre.org
https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0 | source : cve@mitre.org
https://github.com/jhipster/generator-jhipster/issues/2095 | source : cve@mitre.org


Vulnerability ID : CVE-2023-27846

First published on : 31-10-2023 04:15:11
Last modified on : 31-10-2023 12:58:31

Description :
SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components.

CVE ID : CVE-2023-27846
Source : cve@mitre.org
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2023/10/25/tvcmsblog.html | source : cve@mitre.org


Vulnerability ID : CVE-2023-45378

First published on : 31-10-2023 04:15:11
Last modified on : 31-10-2023 12:58:31

Description :
In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.

CVE ID : CVE-2023-45378
Source : cve@mitre.org
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2023/10/26/prestablog.html | source : cve@mitre.org


Vulnerability ID : CVE-2023-46356

First published on : 31-10-2023 04:15:11
Last modified on : 31-10-2023 12:58:31

Description :
In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.

CVE ID : CVE-2023-46356
Source : cve@mitre.org
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2023/10/26/csvfeeds-89.html | source : cve@mitre.org


Vulnerability ID : CVE-2023-47174

First published on : 31-10-2023 04:15:11
Last modified on : 31-10-2023 12:58:31

Description :
Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.

CVE ID : CVE-2023-47174
Source : cve@mitre.org
CVSS Score : /

References :
https://help.thorntech.com/docs/sftp-gateway-gcp-3.0/gcp-java-deserialization-rce/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-43139

First published on : 31-10-2023 05:15:58
Last modified on : 31-10-2023 12:58:31

Description :
An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components.

CVE ID : CVE-2023-43139
Source : cve@mitre.org
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2023/10/25/franfinance.html | source : cve@mitre.org


Vulnerability ID : CVE-2023-45996

First published on : 31-10-2023 06:15:07
Last modified on : 31-10-2023 12:58:31

Description :
SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.

CVE ID : CVE-2023-45996
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-member_type.md | source : cve@mitre.org
https://github.com/slims/slims9_bulian/issues/216 | source : cve@mitre.org


Vulnerability ID : CVE-2023-46361

First published on : 31-10-2023 06:15:08
Last modified on : 31-10-2023 12:58:31

Description :
Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.

CVE ID : CVE-2023-46361
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-46451

First published on : 31-10-2023 07:15:11
Last modified on : 31-10-2023 12:58:31

Description :
Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.

CVE ID : CVE-2023-46451
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/sajaljat/CVE-2023-46451 | source : cve@mitre.org
https://youtu.be/f8B3_m5YfqI | source : cve@mitre.org


Vulnerability ID : CVE-2023-46976

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.

CVE ID : CVE-2023-46976
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20A3300R/1/README.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-46977

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.

CVE ID : CVE-2023-46977
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20LR1200GB/1/README.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-46978

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.

CVE ID : CVE-2023-46978
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/1/README.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-46979

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.

CVE ID : CVE-2023-46979
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/2/README.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-42425

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components.

CVE ID : CVE-2023-42425
Source : cve@mitre.org
CVSS Score : /

References :
http://turing.com | source : cve@mitre.org
https://gist.github.com/stevenliuturing/306bb689737cec5d3a5760c34d65932c | source : cve@mitre.org


Vulnerability ID : CVE-2023-46992

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages.

CVE ID : CVE-2023-46992
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R/readme.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-46993

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.

CVE ID : CVE-2023-46993
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R-Command%20Injection/readme.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-37831

First published on : 31-10-2023 18:15:08
Last modified on : 31-10-2023 18:15:08

Description :
An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.

CVE ID : CVE-2023-37831
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/strik3r0x1/Vulns/blob/main/User%20enumeration%20-%20Elenos.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-37832

First published on : 31-10-2023 18:15:08
Last modified on : 31-10-2023 18:15:08

Description :
A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.

CVE ID : CVE-2023-37832
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/strik3r0x1/Vulns/blob/main/Lack%20of%20resources%20and%20rate%20limiting%20-%20Elenos.md | source : cve@mitre.org


Vulnerability ID : CVE-2023-45955

First published on : 31-10-2023 18:15:08
Last modified on : 31-10-2023 18:15:08

Description :
An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands.

CVE ID : CVE-2023-45955
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Nanoleaf%20Lightstrip%20Vulnerability%20Report.pdf | source : cve@mitre.org


Vulnerability ID : CVE-2023-39610

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request.

CVE ID : CVE-2023-39610
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/zn9988/publications/tree/main/1.TP-Link%20Tapo%20C100%20-%20HTTP%20Denial-Of-Service | source : cve@mitre.org


Vulnerability ID : CVE-2023-43295

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.

CVE ID : CVE-2023-43295
Source : cve@mitre.org
CVSS Score : /

References :
https://www.clickstudios.com.au/security/advisories/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-46484

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.

CVE ID : CVE-2023-46484
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/10/29/x6000r/setLedCfg/TOTOlink%20X6000R%20setLedCfg%20e/ | source : cve@mitre.org


Vulnerability ID : CVE-2023-46485

First published on : 31-10-2023 21:15:08
Last modified on : 31-10-2023 21:15:08

Description :
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.

CVE ID : CVE-2023-46485
Source : cve@mitre.org
CVSS Score : /

References :
https://815yang.github.io/2023/10/29/x6000r/TOTOlink%20X6000R%20V9.1.0cu.2350_B20230313-rsetTracerouteCfg/ | source : cve@mitre.org


Source : jpcert.or.jp

Vulnerability ID : CVE-2015-0897

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.

CVE ID : CVE-2015-0897
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
http://official-blog.line.me/ja/archives/24809761.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN41281927/ | source : vultures@jpcert.or.jp


Vulnerability ID : CVE-2015-2968

First published on : 31-10-2023 10:15:08
Last modified on : 31-10-2023 12:58:27

Description :
LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.

CVE ID : CVE-2015-2968
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
http://official-blog.line.me/ja/archives/36495925.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN22546110/ | source : vultures@jpcert.or.jp


Vulnerability ID : CVE-2016-1203

First published on : 31-10-2023 13:15:09
Last modified on : 31-10-2023 14:23:18

Description :
Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remote unauthenticated attacker to conduct a man-in-the-middle attack. A successful exploitation may result in a malicious file being downloaded and executed.

CVE ID : CVE-2016-1203
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://jvn.jp/en/vu/JVNVU97339542/ | source : vultures@jpcert.or.jp
https://web-support.saat.jp/hc/ja/articles/4406222933785 | source : vultures@jpcert.or.jp


Source : patchstack.com

Vulnerability ID : CVE-2023-24000

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:18

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.

CVE ID : CVE-2023-24000
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-7-unauthenticated-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-25047

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:18

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.

CVE ID : CVE-2023-25047
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-9-9-3-sql-injection-vulnerability-2?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-28777

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.

CVE ID : CVE-2023-28777
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/sfwd-lms/wordpress-learndash-lms-plugin-4-5-3-contributor-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-24410

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin โ€“ Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin โ€“ Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.

CVE ID : CVE-2023-24410
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/fluentform/wordpress-fluentform-plugin-4-3-25-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-31212

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.

CVE ID : CVE-2023-31212
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/contact-form-entries/wordpress-contact-form-entries-plugin-1-3-0-auth-sql-injection-sqli-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-33927

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin โ€“ MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin โ€“ MPG: from n/a through 3.3.19.

CVE ID : CVE-2023-33927
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-mpg-plugin-3-3-19-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-35879

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.

CVE ID : CVE-2023-35879
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-78-shop-manager-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-36508

First published on : 31-10-2023 15:15:08
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft โ€“ Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft โ€“ Messages Database Plugin For WordPress: from n/a through 1.7.1.

CVE ID : CVE-2023-36508
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/contact-form-to-db/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-1-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Vulnerability ID : CVE-2023-37966

First published on : 31-10-2023 15:15:09
Last modified on : 31-10-2023 15:35:00

Description :
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2.

CVE ID : CVE-2023-37966
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/user-activity-log/wordpress-user-activity-log-plugin-1-6-2-sql-injection-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-89


Source : wpscan.com

Vulnerability ID : CVE-2023-4250

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVE ID : CVE-2023-4250
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-4251

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

CVE ID : CVE-2023-4251
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19 | source : contact@wpscan.com

Vulnerability : CWE-352


Vulnerability ID : CVE-2023-4390

First published on : 31-10-2023 14:15:11
Last modified on : 31-10-2023 14:23:15

Description :
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVE ID : CVE-2023-4390
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/9fd2eb81-185d-4d42-8acf-925664b7cb2f | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-4823

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.

CVE ID : CVE-2023-4823
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/84f53e27-d8d2-4fa3-91f9-447037508d30 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-4836

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced

CVE ID : CVE-2023-4836
Source : contact@wpscan.com
CVSS Score : /

References :
https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc | source : contact@wpscan.com
https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6 | source : contact@wpscan.com

Vulnerability : CWE-639


Vulnerability ID : CVE-2023-5098

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.

CVE ID : CVE-2023-5098
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/3167a83c-291e-4372-a42e-d842205ba722 | source : contact@wpscan.com

Vulnerability : CWE-284


Vulnerability ID : CVE-2023-5211

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.

CVE ID : CVE-2023-5211
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/aa868380-cda7-4ec6-8a3f-d9fa692908f2 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5229

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVE ID : CVE-2023-5229
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/fb6ce636-9e0d-4c5c-bb95-dde1d2581245 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5237

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

CVE ID : CVE-2023-5237
Source : contact@wpscan.com
CVSS Score : /

References :
https://research.cleantalk.org/cve-2023-5237-memberlite-shortcodes-stored-xss-via-shortcode | source : contact@wpscan.com
https://wpscan.com/vulnerability/a46d686c-6234-4aa8-a656-00a65c55d0b0 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5238

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.

CVE ID : CVE-2023-5238
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/47a5fbfd-f47c-4356-8567-b29dadb48423 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5243

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE ID : CVE-2023-5243
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/ad895200-a03a-4e92-b256-d6991547d38a | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5307

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.

CVE ID : CVE-2023-5307
Source : contact@wpscan.com
CVSS Score : /

References :
https://research.cleantalk.org/cve-2023-5307-photos-and-files-contest-gallery-contact-form-21-2-8-1-unauthenticated-stored-xss-via-http-headers | source : contact@wpscan.com
https://wpscan.com/vulnerability/6fac1e09-21ab-430d-b56d-195e7238c08c | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5360

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

CVE ID : CVE-2023-5360
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34 | source : contact@wpscan.com

Vulnerability : CWE-434


Vulnerability ID : CVE-2023-5458

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

CVE ID : CVE-2023-5458
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/47d15f1c-b9ca-494d-be8f-63c30e92f9b8 | source : contact@wpscan.com

Vulnerability : CWE-79


Vulnerability ID : CVE-2023-5519

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:23:15

Description :
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

CVE ID : CVE-2023-5519
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19 | source : contact@wpscan.com

Vulnerability : CWE-352


Source : redhat.com

Vulnerability ID : CVE-2023-4610

First published on : 31-10-2023 14:15:12
Last modified on : 31-10-2023 14:15:12

Description :
** REJECT ** The SRCU code was added in upstream kernel v6.4-rc1 and removed before v6.4. This bug only existed in development kernels. Please see https://lore.kernel.org/all/ZTKVfoQZplpB8rki@casper.infradead.org and https://bugzilla.suse.com/show_bug.cgi?id=1215932 for more information.

CVE ID : CVE-2023-4610
Source : secalert@redhat.com
CVSS Score : /

References :


Source : hp.com

Vulnerability ID : CVE-2023-5739

First published on : 31-10-2023 16:15:10
Last modified on : 31-10-2023 17:07:44

Description :
Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege.

CVE ID : CVE-2023-5739
Source : hp-security-alert@hp.com
CVSS Score : /

References :
https://support.hp.com/us-en/document/ish_8128401-8128440-16 | source : hp-security-alert@hp.com


Source : tigera.io

Vulnerability ID : CVE-2023-41377

First published on : 31-10-2023 20:15:09
Last modified on : 31-10-2023 22:15:08

Description :
** REJECT ** REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.

CVE ID : CVE-2023-41377
Source : psirt@tigera.io
CVSS Score : /

References :


This website uses the NVD API, but is not approved or certified by it.

About the author
Julien B.

Securitricks

Up-to-Date Cybersecurity Insights & Malware Reports

Securitricks

Great! Youโ€™ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to Securitricks.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.