Archive
6 December 2022
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Critical 9.1
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
-
High 8.7
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress.
-
Medium 6.8
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
-
Medium 4.8
WordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
-
Medium 6.3
DSInternals Credential Roaming Elevation of Privilege Vulnerability
### Impact A vulnerability exists in the `DSInternals.Common.Data.RoamedCredential.Save()` method, which incorrectly parses the `msPKIAccountCredentials` LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the…
-
Medium 6.1
WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
-
Critical 9.8
WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation
Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
-
Critical 9.8CVE-2022-45359 EPSS 14%
WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload
Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
-
High 7.2
Proofpoint Enterprise Protection perl eval() arbitrary command execution
The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope. This affects all versions 8.19.0 and below.
-
Critical 9.6
Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"
The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface. This affects all versions 8.19.0 and b…
-
High 8.8
dalorRadius full account take over
daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file bec…
-
Critical 10.0
Code injection in pdfmake
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of…
-
High 7.8
IBM Spectrum Scale command execution
IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437.
-
High 8.6
Arbitrary file access in KodExplorer
Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host proc…
-
Medium 5.4
DOM-based cross-site scripting (XSS) in teler dashboard
teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint,…
-
Medium 5.9
IBM Sterling Secure Proxy information disclosure
IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 230522.
-
High 8.6
Arbitrary file access in the Galaxy data analysis platform
Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This v…
-
Medium 5.9
Use of insecure random number generator in Passeo
Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptog…
-
Medium 5.1
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet Forti…
-
Medium 5.1
Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through…
-
Low 3.4
Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may all…
-
Low 3.6
An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.…
-
Low 3.8
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.…
-
High 7.7
An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.…
-
High 8.7
Insufficient validation of plugin files
Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.
-
Medium 6.1
WP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.
-
Low 3.3
Information Exposure Vulnerability in JP1/Automatic Operation
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09…
-
Medium 6.3
Reflected XSS
Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attacker…
-
Critical 9.8
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS comma…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
Medium 4.7
In audio driver, there is a use after free due to a race condition. This could lead to local denial of service in kerne…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
Medium 5.5
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local …
-
Medium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of ser…