Archive
23 August 2021
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
Medium 5.6
IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which crea…
-
Medium 5.9
IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen…
-
Unscored —
Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-…
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 8.2
Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 8.8
Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
-
Unscored —
Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
-
Unscored —
HM Multiple Roles < 1.3 - Arbitrary Role Change
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
-
Unscored —
Simple Banner < 2.10.4 - Authenticated Stored XSS
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
-
Unscored —
HD Quiz < 1.8.4 - Authenticated Stored XSS
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
-
Unscored —
Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in a…
-
Unscored —
WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
-
Unscored —
LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
-
Unscored —
WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
-
Unscored —
Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, lead…
-
Unscored —
M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
-
Unscored —
Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting th…
-
Unscored —CVE-2021-24554 Scanner template
Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue
-
Unscored —
Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, th…
-
Unscored —
Timeline Calendar <= 1.2 - Authenticated (admin+) SQL Injection
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in t…
-
Unscored —
Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL Injection
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
-
Unscored —
Edit Comments <= 0.3 - Unauthenticated SQL Injection
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
-
Unscored —
Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL Injection
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue
-
Unscored —
AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File Access
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrato…
-
Unscored —
KN Fix Your Title <= 1.0.1 - Authenticated Stored XSS
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.
-
Unscored —
Maintenance < 4.03 - Authenticated Stored XSS
The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be trigg…
-
Unscored —
Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.
-
Unscored —
Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)
The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.
-
Unscored —
GiveWP < 2.12.0 - Authenticated Stored XSS
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
-
Unscored —
Slider Hero < 8.2.7 - Contributor+ SQL Injection
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perf…
-
Unscored —
Giveaway <= 1.2.2 - Authenticated SQL Injection
The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $post_id on the options.php page.
-
Unscored —
Simple Social Media Share Buttons < 3.2.3 - Contributor+ Stored XSS
The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-…
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful …
-
Unscored —
Regression of CVE-2017-12613
An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 a…
-
Unscored —
Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113,…
-
Unscored —
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.…