Archive
17 October 2022
Vulnerabilities first published on this day (UTC), newest first.
47 results · Clear filters · Feed
-
Medium 4.8
WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress.
-
Medium 6.5
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy cre…
-
Medium 4.3
It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions f…
-
Medium 5.5
Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free
A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…
-
Medium 4.2
Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce
-
Medium 4.8
We’re Open! < 1.42 - Admin+ Stored Cross-Site Scripting
The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exa…
-
Medium 4.6
Exim Regex use after free
A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is reco…
-
Medium 5.9
Passster < 3.5.5.5.2 - Insecure Storage of Password
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
-
Medium 4.7
SourceCodester Simple Cold Storage Management System Avatar unrestricted upload
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulatio…
-
Medium 5.5
X.org Server xkb.c _GetCountedString buffer overflow
A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The asso…
-
Medium 4.6
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recomme…
-
Medium 5.6
Privilege escalation in Google Drive for Desktop on MacOS
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that dire…
-
Medium 5.3
Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15…
-
Medium 4.3
An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions startin…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 …
-
Medium 4.6
Linux Kernel IPv6 inet6_dgram_ops race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch …
-
Medium 4.3
Frontend File Manager < 21.4 - File Upload via CSRF
The Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf
-
Medium 5.5
Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recomm…
-
Medium 6.5
miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example
-
Medium 4.3
WP Custom Cursors < 3.0.1 - Arbitrary Cursor Deletion via CSRF
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack.
-
Medium 5.5
Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free
A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. Upgrading to ve…
-
Medium 6.5
Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, an…
-
Medium 4.3
Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit a…
-
Medium 4.6
Linux Kernel TCP tcp_setsockopt race condition
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated wit…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting f…
-
Medium 6.5
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 befo…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Medium 6.1
WP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRF
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation …
-
Medium 6.5
An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input…
-
Medium 6.5
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended for…
-
Medium 5.3
Helpful < 4.5.26 - Information Disclosure
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address dependin…
-
Medium 6.4
A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and …
-
Medium 4.8
Meks Easy Social Share < 1.2.8 - Admin+ Stored Cross-Site Scripting
The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallo…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting …
-
Medium 4.8
Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in mul…
-
Medium 6.5
A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior …
-
Medium 6.5
A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, a…
-
Medium 4.3
A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions st…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions …
-
Medium 6.1
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a diffe…