CVE Vulnerability Advisory Database

[Affected Scope] Payment Forms for Paystack WordPress plugin versions before 4.0.6

[Impact] Users with Contributor role and above can view sensitive live and test Paystack API secret keys, granting full access to the site owner's payment account

[Mitigation] Immediately update the plugin to version 4.0.6 or higher and rotate all potentially exposed API secret keys

[Affected Scope] Network devices and virtual appliances running Cisco Catalyst SD-WAN Software

[Impact] Attackers can bypass file system restrictions via vshell access to read sensitive underlying operating system information

[Mitigation] Apply the official Cisco security patches immediately and restrict vshell/CLI access privileges

[Affected Scope] All Wing FTP Server installations running versions prior to 7.4.4

[Impact] Attackers can disclose the full local installation path of the application by supplying an excessively long value in the UID cookie, facilitating subsequent targeted attacks

[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and deploy WAF rules to restrict anomalous cookie lengths in the interim

[Affected Scope] Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via T3 or IIOP protocols to gain unauthorized access to critical data or compromise all accessible data.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/disable T3 and IIOP protocols if they are not required.