Archive
8 February 2023
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
Medium 5.4
WordPress SeoSamba for WordPress Webmasters Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.
-
High 7.5
DoS in APROLs Tbase server
B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.
-
Critical 9.8
Buffer overflow when changing configuration on Tbase Server
Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.
-
High 7.5
Lack of checking preconditions in APROL
Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.
-
High 7.5
Memory leak when receiving messages in APROL Tbase server
Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages
-
Critical 9.4
Lack of authentication when managing APROL database
Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration.
-
Medium 6.1
Yellow Yard Searchbar < 2.8.2 - Reflected Cross-Site Scripting
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes it possible for unauthenticated at…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_state function. This makes it possible for unauthenticated att…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscribe…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-le…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-leve…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-l…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible for unauthenticated a…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes it possible for unauthenticated att…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_unassign_folders function. This makes it possible for unauthenticat…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscrib…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-lev…
-
High 7.5
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing
CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. When creati…
-
High 8.2
Cross-site Scripting (XSS) - Generic in answerdev/answer
Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
-
High 8.0
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
-
Critical 9.8CVE-2023-0744 Public exploit
Improper Access Control in answerdev/answer
Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
-
High 8.2
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
-
High 8.1
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answer
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.
-
Medium 5.5
Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
-
Medium 6.4CVE-2023-0748 Public exploit
Open Redirect in btcpayserver/btcpayserver
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
-
High 8.0
Cross-site Scripting (XSS) - DOM in answerdev/answer
Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
-
High 7.8
Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to a…
-
Medium 6.5
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated u…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
Critical 9.8
Deserialization of Untrusted Data in thinkphp
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
-
Medium 5.4
Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page…
-
Critical 9.8
File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to …
-
Critical 9.8
SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arb…
-
High 7.6
An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring a…