Archive
25 October 2021
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Unscored —
Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capa…
-
Unscored —
Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (h…
-
Unscored —
jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting…
-
Unscored —
Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site Scripting
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
-
Unscored —
In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This…
-
Unscored —
Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
-
Unscored —
Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
-
Unscored —
St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to…
-
Unscored —
Special Text Boxes < 5.9.110 - Admin+ Stored Cross-Site Scripting
The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
-
Unscored —
YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with t…
-
Unscored —
NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site Scripting
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability …
-
Unscored —
In TBD of TBD, there is a possible out of bounds write due to improper locking. This could lead to local escalation of …
-
Unscored —
In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local …
-
Unscored —
In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …
-
Unscored —
In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escala…
-
Unscored —
In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escala…
-
Unscored —
In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escala…
-
Unscored —
In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation…
-
Unscored —
In display driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Unscored —
In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa…
-
Unscored —
In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of ser…
-
Unscored —
In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of ser…
-
Unscored —
In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local inform…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Medium 5.4
Piranha CMS - Stored XSS in Page Title
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
-
Unscored —
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron Ap…
-
Medium 6.7
Unquoted Path (SMB Login) Vulnerability
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerab…
-
Critical 9.8
Unsafe Pre-Authentication Deserialization In Workers
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgra…
-
Critical 9.8
Shell Command Injection Vulnerability in Nimbus Thrift Server
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authenti…