Know your exposure.
Stay ahead of threats.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaus…

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no si…

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the…

sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an i…