Archive
17 January 2022
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Unscored —
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in th…
-
Medium 6.1
DOM based XSS Vulnerability in Apache Knox
When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by …
-
High 7.2
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
-
Medium 6.3
IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary co…
-
Medium 6.1
Cross-site Scripting in epubjs
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 8.3
SQL Injection in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
-
Medium 5.3
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.4
Cross-site Scripting (XSS) - Reflected in icecoder/icecoder
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.2
NULL Pointer Dereference in mruby/mruby
mruby is vulnerable to NULL Pointer Dereference
-
High 7.1
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Unscored —CVE-2021-25067 Scanner template
Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
-
Unscored —CVE-2021-25065 Scanner template
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
-
Unscored —
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
-
Unscored —
Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
-
Unscored —
All In One SEO < 4.1.5.3 - Authenticated SQL Injection
The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s…
-
Unscored —
All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation
The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access …
-
Unscored —
Event Calendar < 1.1.51 - Reflected Cross-Site Scripting
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
-
Unscored —
SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site Scripting
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Unscored —
ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
-
Unscored —CVE-2021-24838 Scanner template
AnyComment < 0.3.5 - Open Redirect
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
-
High 7.6
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
-
Unscored —
-
Unscored —
project abandoned
The `r2d2-odbc-api` crate might be an alternative.
-
High 7.3
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.7
Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
-
Unscored —
Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R790…
-
Unscored —
Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmwar…
-
Unscored —
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticat…
-
Unscored —
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attac…
-
Unscored —
Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this v…
-
Medium 4.7
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
-
Unscored —CVE-2022-23303 Public exploit
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks…
-
Unscored —
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel att…
-
Unscored —
Event Calendar < 1.1.51 - Subscriber+ Event Creation
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events