Archive
28 October 2022
Vulnerabilities first published on this day (UTC), newest first.
33 results · Clear filters · Feed
-
Medium 6.1
Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att…
-
Medium 6.5
Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causin…
-
Medium 6.5
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_sa…
-
Medium 5.4
WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
-
Medium 4.8
WordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress.
-
Medium 4.3
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Conten…
-
Medium 6.5
The FILES Directive allows arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from that template, which may result in Information Disclosure.
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.
-
Medium 6.7
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restr…
-
Medium 6.7
Lock WARP switch bypass on WARP mobile client using iOS quick action
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" qui…
-
Medium 6.7
Lock WARP switch bypass by removing VPN profile on iOS mobile client
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on…
-
Medium 6.7
Lock WARP switch feature bypass on WARP mobile client for iOS
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable f…
-
Medium 6.7
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.
-
Medium 5.4
OctoRPKI crash when maximum iterations number is reached
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika M…
-
Medium 6.3
Redis on Windows dbghelp.dll uncontrolled search path
A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated …
-
Medium 6.3
seccome Ehoney set sql injection
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VD…
-
Medium 6.3
seccome Ehoney signup access control
A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerabi…
-
Medium 6.3
seccome Ehoney falco sql injection
A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. Th…
-
Medium 6.3
seccome Ehoney attack sql injection
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely.…
-
Medium 5.0
SourceCodester Web-Based Student Clearance System edit-admin.php sql injection
A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to in…
-
Medium 6.8
An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all ver…
-
Medium 6.3
seccome Ehoney token sql injection
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launch…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions star…
-
Medium 6.5CVE-2022-26884 Public exploit
Apache DolphinScheduler exposes files without authentication
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
-
Medium 5.4CVE-2022-43166 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) …
-
Medium 5.4CVE-2022-43167 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_ale…
-
Medium 5.4CVE-2022-43164 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of…
-
Medium 5.4CVE-2022-43169 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/us…
-
Medium 5.4CVE-2022-43170 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_co…
-
Medium 5.4CVE-2022-43165 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) …
-
Medium 5.5
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
-
Medium 5.4
Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.
-
Medium 6.1
SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.
-
Medium 5.4
Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.