Archive
7 February 2022
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
High 8.1
Validation bypass in frourio
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for r…
-
High 8.1
Validation bypass in frourio-express
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Valid…
-
High 8.2
The RNDIS USB device class includes a buffer overflow vulnerability
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
-
High 8.2
Buffer overflow in usb device class
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
-
High 7.8
Privilege escalation on xrdp
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root.…
-
Unscored —
QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the u…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can …
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for priv…
-
Critical 9.3
Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x
A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.
-
Medium —CVE-2022-22931 Public exploit
Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by …
-
High 7.7
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 6.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 5.3
Microsoft Edge (Chromium-based) Tampering Vulnerability
Microsoft Edge (Chromium-based) Tampering Vulnerability
-
Unscored —CVE-2022-0149 Scanner template
WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
-
Unscored —CVE-2022-0148 Scanner template
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
-
Unscored —
IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing u…
-
Unscored —
Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
-
Unscored —
WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscribe…
-
Unscored —
Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting
The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
GTranslate < 2.9.7 - Reflected Cross-Site Scripting
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: ex…
-
Unscored —
IP2Location Country Blocker < 2.26.5 - Ban Bypass
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
-
Unscored —
Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or re…
-
Unscored —
Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
-
Unscored —
Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Unscored —
SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than …
-
Unscored —
Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's setting…
-
Unscored —CVE-2021-24947 Scanner template
RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read
The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary fi…
-
Unscored —
Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authe…
-
Unscored —
SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
-
Unscored —
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists d…
-
Unscored —
SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
-
Unscored —CVE-2021-24878 Scanner template
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
-
Unscored —
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_acti…
-
Unscored —
IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by…
-
Unscored —
FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed success…
-
Unscored —
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application …
-
Low 2.4
Disclosure of mail addresses
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 an…
-
Low 3.8
Dynamic field error message is vulnerable to XSS
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.…
-
Unscored —
In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server…
-
Medium 6.5
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service managem…