Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
1,042 results · Clear filters · Feed
-
Medium 6.5
Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remo…
-
Medium 5.5
Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Information Disclosure Vulnerability
-
Medium 6.3
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
-
Medium 4.7CVE-2023-21766 Public exploit
Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability
-
Medium 6.8CVE-2023-21563 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Information Disclosure Vulnerability
-
Medium 4.7
Event Tracing for Windows Information Disclosure Vulnerability
Event Tracing for Windows Information Disclosure Vulnerability
-
Medium 5.3
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft SharePoint Server Security Feature Bypass Vulnerability
-
Medium 5.3
Windows Point-to-Point Protocol (PPP) Information Disclosure Vulnerability
Windows Point-to-Point Protocol (PPP) Information Disclosure Vulnerability
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 5.5
Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Information Disclosure Vulnerability
-
Medium 5.5
Event Tracing for Windows Information Disclosure Vulnerability
Event Tracing for Windows Information Disclosure Vulnerability
-
Medium 5.3
Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
-
Medium 6.6CVE-2023-21560 Public exploit
Windows Boot Manager Security Feature Bypass Vulnerability
Windows Boot Manager Security Feature Bypass Vulnerability
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. Spec…
-
Medium 6.5
workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submit…
-
Medium 5.9
Zip4j Origin Validation Error
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
-
Medium 6.1
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Wi…
-
Medium 6.4
A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could…
-
Medium 4.8
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS).…
-
Medium 6.1
An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Script…
-
Medium 4.3
A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
-
Medium 5.5
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is …
-
Medium 6.5
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of u…
-
Medium 4.3
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic use…
-
Medium 4.3
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic use…
-
Medium 6.5
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-con…
-
Medium 5.3
In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error m…
-
Medium 6.1
phoenix_html allows Cross-site Scripting in HEEx class attributes
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
-
Medium 6.1CVE-2022-4325 Scanner template
Post Status Notifier Lite < 1.10.1 - Reflected XSS
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
-
Medium 5.4
Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSS
The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Medium 6.1
WP CSV <= 1.8.0.0 - Reflected XSS via CSV Import
The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.
-
Medium 4.8
404 to Start <= 1.6.1 - Admin+ Stored XSS
The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for …
-
Medium 4.3
Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary…
-
Medium 4.8
Multi Step Form < 1.7.8 - Admin+ Stored XSS
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed …
-
Medium 6.1
Bg Bible References <= 3.8.14 - Reflected XSS
The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
-
Medium 4.3
Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a p…
-
Medium 6.1CVE-2022-4301 Scanner template
Sunshine Photo Cart < 2.9.15 - Reflected XSS
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
-
Medium 5.4
Jetpack CRM < 5.5 - Contributor+ Stored XSS
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which c…
-
Medium 4.3
ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.