Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
Unscored —
ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
-
Unscored —CVE-2021-24838 Scanner template
AnyComment < 0.3.5 - Open Redirect
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
-
High 7.6
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
-
Unscored —
-
Unscored —
project abandoned
The `r2d2-odbc-api` crate might be an alternative.
-
High 7.3
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.7
Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
-
Unscored —
Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R790…
-
Unscored —
Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmwar…
-
Unscored —
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticat…
-
Unscored —
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attac…
-
Unscored —
Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this v…
-
Medium 4.7
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
-
Unscored —CVE-2022-23303 Public exploit
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks…
-
Unscored —
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel att…
-
Unscored —
Event Calendar < 1.1.51 - Subscriber+ Event Creation
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
-
High 7.3
Cross-site Scripting (XSS) - Stored in janeczku/calibre-web
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.5
Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 8.8
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
-
Unscored —
The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.
-
Unscored —
The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (t…
-
Unscored —
ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading …
-
Unscored —
A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote at…
-
Unscored —
Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input valida…
-
Unscored —
Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validati…
-
Unscored —
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
-
Unscored —
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
-
Unscored —
Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.
-
Unscored —
An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI…
-
High 7.8
Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a cra…
-
Unscored —
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated pri…
-
Unscored —
China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by …
-
Unscored —
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cra…
-
Critical 9.8
Access of Resource Using Incompatible Type in Hermes
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a…
-
Medium —
Improper Privilege Management in shelljs
### Impact Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root us…
-
Medium 4.0
Information Exposure
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
-
Unscored —
Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.
-
Unscored —
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string…