Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
YOP Poll < 6.4.3 - IP Spoofing
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
-
Unscored —
Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
-
Medium 4.0
Crafted backend URLs in Lura Project
Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerabil…
-
Unscored —
Event Timeline <= 1.1.5 - Admin+ Stored Cross-Site Scripting
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Unscored —
Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
High 7.3
Improper Authorization in User Management to Vertical Privilege Escalation
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical …
-
Low 3.7
Cross-Site Request en Bulk operation (User operation)
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
-
Low 3.7
Improper Access Control in Configuration (Credential store)
Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.
-
Unscored —
In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer ove…
-
High 7.2CVE-2022-36799 EPSS 47%
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has…
-
High 7.4
Authenticated requests for server update admin API allows path traversal in minio
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path req…
-
High 8.6
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in …
-
Medium 6.5
Out-of-bounds Write to API in vim/vim
Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.