Archive
17 November 2021
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Unscored —
QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
-
Unscored —
QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response statu…
-
Unscored —
MouseWheel Smooth Scroll < 5.7 - Plugin's Setting Update via CSRF
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access
The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are n…
-
Unscored —
Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post'…
-
Unscored —
SEO Redirection < 8.2 - Subscriber+ SQL Injection
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL inj…
-
Unscored —
Helpful < 4.4.59 - Admin+ Stored Cross-Site Scripting
The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Unscored —
YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of …
-
Unscored —
YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the app…
-
Unscored —
Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallow…
-
Unscored —
Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be upd…
-
Unscored —
Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF
The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack
-
Unscored —
My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against …
-
Unscored —
Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Unscored —
WP Performance Score Booster < 2.1 - Settings Change via CSRF
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
-
Unscored —
Stream < 3.8.2 - Admin+ SQL Injection
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
-
Unscored —
Email Log < 2.4.7 - Admin+ SQL Injection
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
-
Unscored —
Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting
The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Unscored —
SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_scri…
-
High 7.8
Free of static data in accountsservice
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the…
-
Unscored —
An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.
-
Unscored —
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pg…
-
Unscored —
A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.…
-
High 8.2
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing c…
-
Unscored —
FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal fu…
-
Unscored —
In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…