Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page – Hit Counter: from n/a through 1.4.14.3.
AFFECTED_PRODUCTS:
Lindeni Who Hit The Page Hit Counter
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
AFFECTED_PRODUCTS:
Wpvibes Redirect 404 Error Page To Homepage Or Custom Page With Logs
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.
AFFECTED_PRODUCTS:
Masterslider Master Slider
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
AFFECTED_PRODUCTS:
Esiteq Wp Report Post
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
AFFECTED_PRODUCTS:
Woo Product Vendors
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug.
This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distribute...
AFFECTED_PRODUCTS:
Gallagher Controller 7000 Firmware,
Gallagher Controller 7000 Firmware,
Gallagher Controller 7000 Firmware
... (+1)
Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.
AFFECTED_PRODUCTS:
Affiliatebooster Affiliate Booster
Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
AFFECTED_PRODUCTS:
Marketingrapel Mkrapel Regiones Y Ciudades De Chile Para Wc
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.
AFFECTED_PRODUCTS:
Villatheme Product Size Chart For Woocommerce
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
AFFECTED_PRODUCTS:
Wpdoctor Woocommerce Login Redirect
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
AFFECTED_PRODUCTS:
Arulprasadj Prevent Landscape Rotation
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3....
AFFECTED_PRODUCTS:
Bluecoral Chat Bubble
Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9.
AFFECTED_PRODUCTS:
Codeastrology Quantity Plus Minus Button For Woocommerce
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols.
This issue affects: Gallagher Diagnostics Service prior to v1.3.0 (distributed in 9.00.1507(MR1))...
AFFECTED_PRODUCTS:
Gallagher Command Centre,
Gallagher Command Centre
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages.
This issue affe...
AFFECTED_PRODUCTS:
Gallagher Controller 6000 Firmware,
Gallagher Controller 6000 Firmware
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.
This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60...
AFFECTED_PRODUCTS:
Gallagher Controller 6000 Firmware,
Gallagher Controller 6000 Firmware
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable.
This issue affects: Gallagher Command Centre 8.70 prior to vEL8.70.1787 (MR2), 8.60 prior to vEL8.60.2039 (MR4),...
AFFECTED_PRODUCTS:
Gallagher Command Centre,
Gallagher Command Centre,
Gallagher Command Centre
Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision.
This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2),...
AFFECTED_PRODUCTS:
Gallagher Command Centre,
Gallagher Command Centre,
Gallagher Command Centre
... (+2)
Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior.
This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of 8.80 and prior.
AFFECTED_PRODUCTS:
Gallagher Command Centre,
Gallagher Command Centre
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface.
This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a...
AFFECTED_PRODUCTS:
Gallagher Command Centre,
Gallagher Command Centre,
Gallagher Command Centre
... (+7)
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805.
AFFECTED_PRODUCTS:
IBM Cloud Pak For Business Automation,
IBM Cloud Pak For Business Automation,
IBM Cloud Pak For Business Automation
... (+7)
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
AFFECTED_PRODUCTS:
Siteorigin Siteorigin Widgets Bundle
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
AFFECTED_PRODUCTS:
Swteplugins Swift Performance
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
AFFECTED_PRODUCTS:
Thememylogin 2fa
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
AFFECTED_PRODUCTS:
Quttera Quttera Web Malware Scanner
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
AFFECTED_PRODUCTS:
Stellarwp The Events Calendar
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
AFFECTED_PRODUCTS:
Wpfrank Slider Factory Pro
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
AFFECTED_PRODUCTS:
Quttera Quttera Web Malware Scanner
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
AFFECTED_PRODUCTS:
Wpmudev Smartcrawl
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to P...
AFFECTED_PRODUCTS:
Soflyy Export Any Wordpress Data To Xml\/csv,
Soflyy Wp All Export
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
AFFECTED_PRODUCTS:
Soflyy Export Any Wordpress Data To Xml\/csv,
Soflyy Wp All Export
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
AFFECTED_PRODUCTS:
Multivendorx Product Catalog Mode For Woocommerce
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attack...
AFFECTED_PRODUCTS:
Codesmade Autocomplete Location Field Contact Form 7,
Codesmade Autocomplete Location Field Contact Form 7
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
AFFECTED_PRODUCTS:
Soflyy Export Any Wordpress Data To Xml\/csv,
Soflyy Wp All Export
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode.
AFFECTED_PRODUCTS:
Maurice Vrm360
IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gai...
AFFECTED_PRODUCTS:
IBM I,
IBM I,
IBM I
... (+2)
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host...
AFFECTED_PRODUCTS:
Debian Debian Linux,
Debian Debian Linux,
Debian Debian Linux
... (+1)
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Debian Debian Linux,
OpenBSD Openssh
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.
AFFECTED_PRODUCTS:
Cambiumnetworks Epmp Force 300 25 Firmware
Rejected reason: This flaw was found to be a duplicate of CVE-2023-6927. Please see https://access.redhat.com/security/cve/CVE-2023-6927 for information about affected products and security errata.
Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4.
AFFECTED_PRODUCTS:
Svgator Svgator
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
AFFECTED_PRODUCTS:
Crocoblock Jetelements For Elementor
Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
AFFECTED_PRODUCTS:
Wpfoxly Adfoxly
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connectio...
AFFECTED_PRODUCTS:
Crushftp CrushFTP,
Crushftp CrushFTP,
Apple macOS
... (+67)
Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.
AFFECTED_PRODUCTS:
Teachpress Project Teachpress
Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
AFFECTED_PRODUCTS:
Saintsystems Disable User Login
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
AFFECTED_PRODUCTS:
Automattic Canada Post Shipping Method
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
AFFECTED_PRODUCTS:
Automattic Woocommerce Bookings
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
AFFECTED_PRODUCTS:
Taggbox Taggbox
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, le...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+2)