Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
390 results · Clear filters · Feed
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attac…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software al…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by t…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames o…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full na…
-
Medium 5.9
Logic error in Matrix SDK for Android
A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted …
-
Medium 5.9
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were ori…
-
Medium 4.9
Open Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
-
Medium 5.4
Denial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
-
Medium 6.0
Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
-
Medium 4.4
Issue when Configuring the ImageMagick Security Policy
ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read …
-
Medium 5.4
GNU Mailman Postorius Access Control Issues
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first …
-
Medium 4.9
Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.1
SMS OVH <= 0.1 Reflected Cross-Site Scripting
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
-
Medium 6.1
MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
-
Medium 6.1
WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versio…
-
Medium 6.1
GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and inc…
-
Medium 6.1
YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and includin…
-
Medium 6.1
Simple Matted Thumbnails <= 1.01 Reflected Cross-Site Scripting
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and…
-
Medium 6.1
Custom Website Data <= 2.2 Reflected Cross-Site Scripting
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
-
Medium 6.1
Bug Library <= 2.0.3 Reflected Cross-Site Scripting
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.
-
Medium 6.1
Edit Comments XT <= 1.0 Reflected Cross-Site Scripting
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
-
Medium 6.1
Wise Agent Capture Forms <= 1.0 Reflected Cross-Site Scripting
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and in…
-
Medium 6.1
DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
-
Medium 6.1
Notices <= 6.1 Reflected Cross-Site Scripting
The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1.
-
Medium 6.1
Border Loading Bar <= 1.0.1 Reflected Cross-Site Scripting
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to a…
-
Medium 6.1
WP-T-Wap <= 1.13.2 Reflected Cross-Site Scripting
The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2.
-
Medium 6.1
WP Scrippets <= 1.5.1 Reflected Cross-Site Scripting
The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.
-
Medium 6.1
Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2…
-
Medium 6.1
WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting
The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in v…
-
Medium 6.1
Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
-
Medium 6.1
Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site Scripting
The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions …
-
Medium 6.1
Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.
-
Medium 6.1
Post Title Counter <= 1.1 Reflected Cross-Site Scripting
The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
-
Medium 6.1
Advance Search <= 1.1.2 Reflected Cross-Site Scripting
The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to a…
-
Medium 6.1
On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting
The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to a…
-
Medium 6.1
RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in version…
-
Medium 6.1
Yet Another bol.com Plugin <= 1.4 Reflected Cross-Site Scripting
The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.
-
Medium 6.1
WP Design Maps & Places <= 1.2 Reflected Cross-Site Scripting
The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.