Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
1,999 results · Feed
-
High 8.2
Stored XSS via SVG in Requarks/wiki
Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a st…
-
High 8.2
Stored XSS in non-image uploads in Requarks/wiki
Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute in…
-
Medium 6.1
IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript …
-
Unscored —
security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the …
-
Unscored —
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by …
-
Unscored —
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated priv…
-
Unscored —
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with…
-
Unscored —
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed c…
-
Unscored —
Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to co…
-
Medium 6.8
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
Unscored —
rental is unmaintained, author has moved on
The author encourages users to explore other solutions, or maintain a fork. Maintained alternatives include: * [`ouroboros`](https://crates.io/crates/ouroboros) * [`fortify`](https://crates.io/crates/fortify) * [`escher`](https://crates.io/crates/escher)
-
Unscored —
An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to a…
-
Unscored —
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on t…
-
Unscored —
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
-
Unscored —
glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request…
-
Unscored —CVE-2021-24997 Scanner template
WP Guppy < 1.3 - Sensitive Information Disclosure
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to sen…
-
Unscored —
Simple JWT Login < 3.3.0 - Insecure Password Creation
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and …
-
Unscored —
Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting
The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltere…
-
Unscored —
WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
-
Unscored —
WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and …
-
Unscored —
Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
-
Unscored —CVE-2021-24979 Scanner template
Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
-
Unscored —
Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template A…
-
Unscored —
Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is di…
-
Unscored —
Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against ad…
-
Unscored —
Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
-
High 8.2
Prevent out-of-bounds read in PJSIP
PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. Thi…
-
Critical 9.8
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
-
Unscored —
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string…
-
Unscored —
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object th…
-
High 7.5
Use after free in libpulse-binding
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
-
Unscored —
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
-
High 7.5
Missing Initialization of Resource in pnet
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
-
High 7.5
Panic mishandled in libpulse-binding
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
-
High 7.5
`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
-
Critical 9.8
InputStream::read_exact : `Read` on uninitialized buffer causes UB
An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in acc_reader.
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
-
Unscored —
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memor…
-
High 7.5
vec-const attempts to construct a Vec from a pointer to a const slice
An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.