Archive
30 January 2023
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
Medium 5.4
CPT Bootstrap Carousel <= 1.12 - Contributor+ Stored XSS via Shortcode
The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting at…
-
Medium 6.8
Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via Shortcode
The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via Shortcode
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 6.1
miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to i…
-
Medium 5.4
Simple Sitemap < 3.5.8 - Contributor+ Stored XSS
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks wh…
-
Medium 5.4
WP Extended Search < 2.1.2 - Contributor+ Stored XSS via Shortcode
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 4.3
WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'
The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'
-
Medium 5.4
WP Tabs < 2.1.17 - Contributor+ Stored XSS
The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cro…
-
High 7.5
AAWP < 3.12.3 - Unsafe URL Handling
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
-
Medium 5.4
Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via Shortcode
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack…
-
Medium 5.4CVE-2022-4306 Scanner template
Panda Pods Repeater Field < 1.5.4 - Reflected XSS
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
-
Medium 5.4
CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode
The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
High 7.8
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Custome…
-
High 7.5
Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.
-
High 8.3
Password reset interception via API
AMI Megarac Password reset interception via API
-
Medium 5.3
PrivateContent <= 8.4.3 - Protection Mechanism Bypass
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rathe…
-
High 7.8
Use after free in io_uring in the Linux Kernel
There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not t…
-
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
Critical 9.1
An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A speciall…
-
Medium 6.8
A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially cra…
-
High 7.5
Servst vulnerable to Path Traversal
Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.
-
High 8.1
Eta vulnerable to Code Injection via templates rendered with user-defined data
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are renderin…
-
Critical 9.8
Vulnerability in QTS
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero …
-
Medium 5.3
safeurl-python contains Server-Side Request Forgery
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
-
Critical 9.8
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
-
High 7.5
Paranoidhttp Server-Side Request Forgery vulnerability
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
-
Medium 6.5
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.…
-
Medium 5.5
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and e…
-
Medium 6.5
SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attac…
-
Medium 6.1
Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject …
-
Medium 6.5
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
Medium 5.3
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could caus…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
High 8.0
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
High 8.0
A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
High 8.0
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE inst…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to …