RMX Security CERT Global

• CVE-2023-41692
  Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <= 3 theme. ... read more
• CVE-2023-41855
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Regpacks Regpack plugin <= 0.1 versions. ... read more
• CVE-2023-41859
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions. ... read more
• CVE-2023-41797
  Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gold Plugins Locations plugin <= 4.0 versions. ... read more
• CVE-2023-41731
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin <= 1.0.2.2 versions. ... read more
• CVE-2023-41800
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in UniConsent UniConsent CMP for GDPR CPRA GPP TCF plugin <= 1.4.2 versions. ... read more
• CVE-2023-41729
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions. ... read more
• CVE-2023-44477
  Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Boxy Studio Cooked plugin <= 1.7.13 versions. ... read more
• CVE-2023-41856
  Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickToTweet.Com Click To Tweet plugin <= 2.0.14 versions. ... read more
• CVE-2023-44479
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jim Krill WP Jump Menu plugin <= 3.6.4 versions. ... read more
• CVE-2023-41736
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Email posts to subscribers plugin <= 6.2 versions. ... read more
• CVE-2023-44474
  Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MD Jakir Hosen Tiger Forms – Drag and Drop Form Builder plugin <= 2.0.0 versions. ... read more
• CVE-2023-41737
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <= 1.2.10 versions. ... read more
• CVE-2023-41847
  Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WEN Solutions Notice Bar plugin <= 3.1.0 versions. ... read more
• CVE-2023-44244
  Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.44 versions. ... read more
• CVE-2023-42132
  FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be ... read more
• CVE-2023-41734
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nigauri Insert Estimated Reading Time plugin <= 1.2 versions. ... read more
• CVE-2023-41733
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in YYDevelopment Back To The Top Button plugin <= 2.1.5 versions. ... read more
• CVE-2023-41728
  Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rescue Themes Rescue Shortcodes plugin <= 2.5 versions. ... read more
• JVN: フルノシステムズ製無線LANアクセスポイント（STモード利用時）における複数の脆弱性
  株式会社フルノシステムズが提供する無線LANアクセスポイント製品（STモード利用時）には、複数の脆弱性が存在します。続きを読む ... read more
• JVN: 医薬品医療機器等法対応医薬品等電子申請ソフトにおける XML 外部実体参照 (XXE) に関する脆弱性
  厚生労働省が提供する医薬品医療機器等法対応医薬品等電子申請ソフトには、XML 外部実体参照 (XXE) に関する脆弱性が存在します。続きを読む ... read more
• CVE-2023-5328
  A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The manipulation with the input auth=user,level1,settings; web=true ... read more
• CVE-2023-5329
  A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the component Web API. The manipulation ... read more
• CVE-2023-5326
  A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebConfig. The manipulation leads ... read more
• CVE-2023-5327
  A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /rest/dir/. The manipulation of ... read more
• CVE-2023-5185 (gym_management_system_project)
  Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on ... read more
• CVE-2022-4956
  A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The manipulation leads to uncontrolled search ... read more
• CVE-2023-5260
  A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the ... read more
• CVE-2023-43944
  A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arbitrary code via parameter field in index.php?page=project_list. ... read more
• CVE-2023-43909
  Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php. ... read more
• CVE-2023-5259
  A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. ... read more
• CVE-2023-5258
  A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql ... read more
• CVE-2023-5261
  A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION_ID leads to ... read more
• CVE-2023-5288
  A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload ... read more
• U.S. Army Cyber Command celebrates 13 years of service
  On Oct. 1, 2023, U.S. Army Cyber Command (ARCYBER) will celebrate 13 years of service, saluting the date in 2010 when the command reached its full opera ... read more
• CVE-2023-5173 (firefox)
  In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly under influence of a local unprivileged webpage), leading to an out-of-bounds write to ... read more
• CVE-2023-5192 (core)
  Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. ... read more
• CVE-2023-5175 (firefox)
  During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codepath, leading to a potentially exploitable crash. This ... read more
• CVE-2023-42487 (soundminer)
  Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ... read more
• CVE-2023-41332 (cilium)
  Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium ... read more
• CVE-2023-43861 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function. ... read more
• CVE-2023-43860 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function. ... read more
• CVE-2023-43863 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function. ... read more
• CVE-2023-43868 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function. ... read more
• CVE-2023-43862 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function. ... read more
• CVE-2023-43864 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function. ... read more
• CVE-2023-43865 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function. ... read more
• CVE-2023-43867 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function. ... read more
• CVE-2023-43866 (dir-619l_firmware)
  D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function. ... read more
• CVE-2023-40668 (save_as_pdf)
  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <= 2.16.0 versions. ... read more