Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
1,042 results · Clear filters · Feed
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…
-
Medium 6.5
Authenticated denial of service
Authenticated denial of service
-
Medium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 1…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting f…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.…
-
Medium 5.3
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4…
-
Medium 6.5
An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing p…
-
Medium 5.5
In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. T…
-
Medium 5.5
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be writte…
-
Medium 5.5
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" b…
-
Medium 5.5
In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This…
-
Medium 4.7
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can over…
-
Medium 5.5CVE-2022-20494 Public exploit
In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could…
-
Medium 5.3
For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.
For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.
-
Medium 6.7
WordPress WP TopBar Plugin <= 5.36 is vulnerable to SQL Injection
Auth. SQL Injection (SQLi) vulnerability in WP-TopBar <= 5.36 versions.
-
Medium 6.5
WordPress Youtube shortcode Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Youtube shortcode <= 1.8.5 versions.
-
Medium 6.5
WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions.
-
Medium 6.2
A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the a…
-
Medium 4.3
My YouTube Channel <= 3.0.12.1 - Missing Authorization
The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber…
-
Medium 6.7
A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly n…
-
Medium 5.5
My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
Medium 6.7
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with e…
-
Medium 6.7
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local …
-
Medium 6.7
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local …
-
Medium 6.7
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileg…
-
Medium 5.4
GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
Medium 5.4
Landing Page Builder < 1.4.9.9 - Contributor+ Cross-Site Scripting via Shortcode
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting at…
-
Medium 5.4
Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting a…
-
Medium 5.4
Page-list < 5.3 - Contributor+ Stored XSS
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which cou…
-
Medium 5.4
Structured Content < 1.5.1 - Contributor+ Stored XSS in Shortcode
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack…
-
Medium 5.4
HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 5.4
Search & Filter < 1.2.16 - Contributor+ Stored XSS
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 5.4
ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which co…
-
Medium 5.4
WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
Print-O-Matic < 2.1.8 - Contributor+ Stored XSS via Shortcode
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
Medium 6.5
Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF
The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
-
Medium 5.4
Content Control < 1.1.10 - Contributor+ Stored XSS
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attac…
-
Medium 5.4
Sitemap < 4.4 - Contributor+ Stored XSS
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could…