Archive
29 November 2022
Vulnerabilities first published on this day (UTC), newest first.
30 results · Clear filters · Feed
-
Medium 6.4
Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes…
-
Medium 4.3
TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible …
-
Medium 5.5
WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att…
-
Medium 6.1
WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting
The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthent…
-
Medium 4.3
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative …
-
Medium 5.3
Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
-
Medium 5.8
Appointment Hour Booking <= 1.3.72 - CSV Injection
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported …
-
Medium 5.3
Quiz and Survey Master <= 8.0.4 - Improper Input Validation
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the speci…
-
Medium 4.7
Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value
The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it…
-
Medium 6.4
Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanit…
-
Medium 5.4
TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting
Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Script…
-
Medium 6.5
Realtek RTL8111FP-CG - Missing Authorization
RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service.
-
Medium 6.5
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not…
-
Medium 6.3
GPAC lsr_dec.c lsr_translate_coords integer overflow
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attac…
-
Medium 6.5
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of…
-
Medium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
-
Medium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
-
Medium 6.1CVE-2022-36433 Public exploit
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript …
-
Medium 4.3
Discourse may allow exposure of hidden tags in the subject of notification emails
Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to…
-
Medium 6.2
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. …
-
Medium 4.3
Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group wr…
-
Medium 5.5
GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomed…
-
Medium 4.3
Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticat…
-
Medium 4.3
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group …
-
Medium 4.3
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group wr…
-
Medium 4.3
Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group writ…
-
Medium 6.1
SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
-
Medium 6.1
Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
-
Medium 5.4
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input repl…
-
Medium 5.4
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subj…