Archive
8 November 2022
Vulnerabilities first published on this day (UTC), newest first.
72 results · Clear filters · Feed
-
Medium —
Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`
The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory. The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4d…
-
Medium 5.3
User login brute force protection functionality bypass
User login brute force protection functionality bypass
-
Medium 5.4
WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.
-
Medium 6.1
WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.
-
Medium 4.8
WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.
-
Medium 4.8
WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.
-
Medium 4.3
WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.
-
Medium 6.3
WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.
-
Medium 5.4
WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.
-
Medium 6.1
WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
-
Medium 5.4
WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.
-
Medium 5.4
WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.
-
Medium 5.4
WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability
Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
-
Medium 4.8
WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability
Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.
-
Medium 4.3
WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
-
Medium 5.4
WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.
-
Medium 5.4
WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.
-
Medium 4.3
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specific…
-
Medium 6.1
Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interf…
-
Medium 5.6
Azure RTOS FileX vulnerable to Buffer Offerflow
Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow a…
-
Medium 5.3
There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker co…
-
Medium 4.8
OpenFGA Authorization Bypass
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*)…
-
Medium 6.7
In isp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…
-
Medium 6.7
In gpu drm, there is a possible out of bounds write due to improper input validation. This could lead to local escalati…
-
Medium 6.8
In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to lo…
-
Medium 6.4
In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.7
In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.8
In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to lo…
-
Medium 6.7
In aee, there is a possible use after free due to a missing bounds check. This could lead to local escalation of privil…
-
Medium 6.7
In audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege …
-
Medium 6.7
In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privi…
-
Medium 6.7
In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege…
-
Medium 5.5
In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati…
-
Medium 5.5
An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could sup…
-
Medium 6.5
The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenti…
-
Medium 5.3
ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them…