Archive
12 June 2020
Vulnerabilities first published on this day (UTC), newest first.
8 results · Clear filters · Feed
-
Medium 6.3
Server-Side Request Forgery in Karaf
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In…
-
Medium 6.8
Authenticated XSS via media attachment page in WordPress
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user wh…
-
Medium 5.7
Open redirect in wp_validate_redirect() in WordPress
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previousl…
-
Medium 5.4
Authenticated XSS through embed block in WordPress
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to…
-
Medium 5.4
IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 6.2
GeoVision Door Access Control Device - Hardcoded privileged password
GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.
-
Medium 4.0
GeoVision Door Access Control Device - Information disclosure vulnerability
GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.
-
Medium 5.9
GeoVision Door Access Control Device - Shared cryptographic keys
GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.