CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6383 – Debug Log Manager < 2.3.0 - Sensitive Logs Exposure
https://notcve.org/view.php?id=CVE-2023-6383
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data El complemento Debug Log Manager de WordPress anterior a 2.3.0 contiene una vulnerabilidad de listado de directorio que le permite descargar el registro de depuración sin autorización y obtener acceso a datos confidenciales. The Debug Log Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.2 due to directory listing allowed in the folder housing debug logs. This makes it possible for unauthenticated attackers to extract data from debug logs. • https://wpscan.com/vulnerability/eae63103-3de6-4100-8f48-2bcf9a5c91fb • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5772 – Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2023-5772
The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento Debug Log Manager para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.2.1 incluida. Esto se debe a una validación nonce faltante o incorrecta en la función clear_log(). • https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.0/classes/class-debug-log.php#L822 https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.2/classes/class-debug-log.php#L828 https://www.wordfence.com/threat-intel/vulnerabilities/id/7e539549-1125-4b0e-aa3c-c8844041c23a?source=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6136 – WordPress Debug Log Manager Plugin <= 2.3.0 is vulnerable to Sensitive Data Exposure
https://notcve.org/view.php?id=CVE-2023-6136
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Bowo Debug Log Manager. Este problema afecta a Debug Log Manager: desde n/a hasta 2.3.0. The Debug Log Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_log() function hooked via AJAX in all versions up to, and including, 2.2.1. This makes it possible for attackers, with subscriber-level access and above, to clear the debug logs. • https://patchstack.com/database/vulnerability/debug-log-manager/wordpress-debug-log-manager-plugin-2-2-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •