Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Medium 5.4
Social Warfare <= 4.3.1 - Cross-Site Request Forgery
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to …
-
Medium 5.4
Social Warfare <= 4.3.0 - Missing Authorization
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissi…
-
Medium 5.9
WAGO: Missing authentication for config export functionality in multiple products
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot fo…
-
High 7.0
Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation v…
-
Low 2.6
gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an…
-
Medium 5.5
Anant Labs google-enterprise-connector-dctm sql injection
A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patc…
-
Medium 6.3
copperwall Twiddit index.php sql injection
A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc.…
-
Medium 5.5
oktora24 2moons sql injection
A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix …
-
Low 3.5
MyCMS Visitors Module view.php build_view cross site scripting
A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting.…
-
Medium 5.6
bastianallgeier Kirby Webmentions Plugin injection
A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is…
-
Medium 5.5
viakondratiuk cash-machine machine.py update_failed_attempts sql injection
A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the p…
-
Medium 4.4
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to…
-
Medium 4.4
A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass acc…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN…
-
Medium 4.9
A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could …
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticat…
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWor…
-
Medium 5.5
A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remot…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.5
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share dev…
-
High 8.6
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unau…
-
High 8.6
A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisc…
-
High 8.8
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local …
-
Medium 5.4
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cr…
-
Critical 9.0CVE-2023-20025 Public exploit
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers c…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV…
-
None 0.0
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could…
-
High 8.1
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Un…
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 7.5
Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated att…
-
Medium 6.8
Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
-
Critical 9.6
DoS: Invalid Initialization in le_read_buffer_size_complete
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
-
Medium 6.5CVE-2022-31901 Public exploit
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the appl…
-
Critical 9.8
Bluetooth HCI Error Handling Double Free
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
-
Critical 9.8CVE-2022-46476 EPSS 41%
D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soa…
-
Medium 5.4CVE-2022-46889 EPSS 60%
A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers t…
-
Critical 9.8CVE-2022-46887 EPSS 19%
Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL comman…
-
Medium 6.1CVE-2022-46888 Scanner template
Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inje…