Archive
15 August 2022
Vulnerabilities first published on this day (UTC), newest first.
56 results · Feed
-
Unscored —CVE-2022-2379 Scanner template
Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API
The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical …
-
Unscored —
Easy Student Results <= 2.2.8 - Reflected Cross-Site Scripting
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
Unscored —
WP-DBManager < 2.80.8 - Admin+ Remote Command Execution
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
-
Unscored —
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
-
Unscored —
GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible rem…
-
Unscored —
Duplicate Page and Post Plugin < 2.8 - Admin+ Stored Cross-Site Scripting
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site Scripting
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
-
Low 3.5
SourceCodester Simple and Nice Shopping Cart Script login.php cross site scripting
A vulnerability has been found in SourceCodester Simple and Nice Shopping Cart Script and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /mkshope/login.php. The manipulation of the argument msg leads to cross…
-
Unscored —
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by …
-
Unscored —
A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 b…
-
Unscored —
Segv on unknown address in jpeg_read_scanlines
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50217 https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.html#decode-jpeg-compressed-blp1-data-in-original-mode ``` Crash type: Segv on unknown address Crash state: jpeg_read_scanl…
-
Unscored —CVE-2020-21365 Public exploit
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclos…
-
Unscored —
There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HT…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0213.