Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
1,522 results · Feed
-
Unscored —
Ninja Forms < 3.6.4 - Admin+ SQL Injection
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
-
Unscored —
Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
-
Unscored —CVE-2021-24876 Scanner template
Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
-
Unscored —
BSK PDF Manager < 3.1.2 - Admin+ SQL Injection
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
-
Unscored —
Bulk Datetime Change < 1.12 - Missing Authorisation
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
-
Unscored —
Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform S…
-
Unscored —
Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to C…
-
Unscored —
myCred < 2.3 - Subscriber+ SQL Injection
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
-
Unscored —
GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
-
Unscored —
URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
-
Unscored —
Email Before Download < 6.8 - Admin+ SQL Injection
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
-
Unscored —
About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
-
Unscored —
myCRED < 1.7.8 - Reflected Cross-Site Scripting
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
-
Unscored —
Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing s…
-
Unscored —
Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as repor…
-
Medium 5.3
Special characters break path parsing in XML functions
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …
-
Critical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…
KEV Dec 1, 2021 -
Medium 5.3
S3Scanner allows Directory Traversal
S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.
-
Unscored —
A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to k…
-
High 8.8
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there…
-
Medium 6.5
An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ b…
-
Unscored —
ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file
-
Unscored —
A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass …
-
High 8.8
Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.6
Improper Input Validation
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a…
-
High 7.6
Cross Site Scripting Vulnerability in @joeattardi/emoji-button
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script…
-
High 7.4
XSS vulnerability in @backstage/plugin-auth-backend
Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacke…
-
High 7.7
Zip Slip Vulnerability in BaserCMS
BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that …
-
Critical 9.1
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. Thi…
-
Medium 6.1
WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
-
Medium 5.5
Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engi…
-
High 7.5
Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series
Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot w…
-
Medium 4.8
WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
-
High 7.8
bandisoft ARK library integer overflow vulnerability
ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.
-
High 8.1
HejHome IP Camera use of hard-coded credentials vulnerability
HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
-
High 7.5
AfreecaTV streamer service stack-based buffer overflow
The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. …
-
High 8.8
An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before vers…
-
Medium 4.4
A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service …
-
High 8.8
Improper Authentication Vulnerability in VioStor
An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of QVR: Q…