CVE-2023-5632
In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6
Source: CVE-2023-5632
CVE-2023-45056
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <=Â 1.3.26 versions.
Source: CVE-2023-45056
CVE-2023-45057
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <=Â 5.86 versions.
Source: CVE-2023-45057
CVE-2023-45059
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <=Â 3.1.0 versions.
Source: CVE-2023-45059
CVE-2023-45062
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <=Â 2.4.6 versions.
Source: CVE-2023-45062
CVE-2023-45064
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <=Â 0.3.1 versions.
Source: CVE-2023-45064
CVE-2023-45051
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <=Â 9.0 versions.
Source: CVE-2023-45051
CVE-2023-45054
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <=Â 2.5 versions.
Source: CVE-2023-45054
CVE-2023-5621
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Source: CVE-2023-5621
CVE-2023-4938
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
Source: CVE-2023-4938