Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
-
Medium 5.9
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
-
Medium 5.9
Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby
kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session…
-
Low 3.6
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loa…
-
Unscored —
Export All URLs < 4.4 - Admin+ Arbitrary System File Removal
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server
-
Unscored —CVE-2022-2599 Scanner template
Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site Scripting
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
-
Unscored —
MailChimp for Woocommerce < 2.7.2 - Admin+ SSRF
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can b…
-
Unscored —
WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site Scripting
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.
-
Unscored —
Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
-
Unscored —
Fluent Support < 1.5.8 - Admin+ SQLi
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
-
Unscored —
WP Hide & Security Enhancer < 1.8 - Reflected Cross-Site Scripting
The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting
-
Unscored —CVE-2022-2373 Scanner template
Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address
-
Unscored —
MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRF
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the …
-
Unscored —
WPide < 3.0 - Admin+ Local File Inclusion
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
-
High 7.5
Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.js
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
-
Medium 5.9
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
-
Medium 6.1
HCL iNotes is susceptible to a link to non-existent domain vulnerability.
HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.
-
High 8.3
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execu…
-
High 8.0
Crafted link in Zulip message can cause disclosure of credentials
Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch w…
-
Unscored —
Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attacke…
-
Unscored —CVE-2022-2034 Scanner template
Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
-
Unscored —
Stop Spam Comments <= 0.2.1.2 - Access Token Bypass
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
-
Unscored —
Leaflet Maps Marker < 3.12.5 - Admin+ SQLi
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.
-
Unscored —CVE-2022-36200 Public exploit
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user conn…
-
Unscored —
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime li…
-
Unscored —
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to cra…
-
Unscored —
A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulner…
-
Unscored —
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …
-
Unscored —
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the comma…
-
Unscored —
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.
-
Unscored —
There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subse…
-
Unscored —
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
-
Unscored —
An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This fla…
-
Unscored —
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancil…
-
Unscored —
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properti…
-
Unscored —
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory ex…
-
Unscored —
A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read du…
-
Unscored —
A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd …
-
Medium 4.9
python-oslo-utils has improper password parsing
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.