Archive
13 March 2023
Vulnerabilities first published on this day (UTC), newest first.
83 results · Feed
-
Medium 4.4
Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting
The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…
-
High 7.2
WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting
The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escapin…
-
High 7.1
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOS…
-
Medium 6.1
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
-
Medium 4.3
WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.
-
Medium 4.3
WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.
-
High 7.5
Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…
-
Medium 5.0
TG Soft Vir.IT eXplorer IoControlCode VIRAGTLT.sys 0x82730088 denial of service
A vulnerability was found in TG Soft Vir.IT eXplorer 9.4.86.0. It has been rated as problematic. This issue affects the function 0x82730088 in the library VIRAGTLT.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The at…
-
High 7.3
XHCMS POST Parameter login.php sql injection
A vulnerability was found in XHCMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php of the component POST Parameter Handler. The manipulation of the argument user leads to sql injection. The attack can be in…
-
Medium 6.3
SourceCodester Yoga Class Registration System manage_category.php query sql injection
A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. This affects the function query of the file admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. I…
-
Medium 4.9
Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi
An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, hav…
-
High 7.3
SourceCodester Online Pizza Ordering System ajax.php sql injection
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The at…
-
Medium 6.3
SourceCodester Online Pizza Ordering System GET Parameter category.php sql injection
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file category.php of the component GET Parameter Handler. The manipulation of the a…
-
Low 3.5
SourceCodester Computer Parts Sales and Inventory System Add User Account cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown function of the component Add User Account. The manipulation of the argument username leads to cross site s…
-
Critical 9.8
Cross-realm object access in Webpack 5
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
-
High 8.4CVE-2023-1362 Scanner template
Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys
Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
-
High 7.2
SQL Injection in unilogies/bumsys
SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2.
-
Medium 6.0
Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
High 7.8
McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the c…
-
Medium 5.5
McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution vi…
-
High 7.5CVE-2023-24033 EPSS 33%
The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets…
-
Critical 9.8
OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands v…
-
Medium 5.5
McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could…
-
High 7.8CVE-2023-27010 Public exploit
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability al…
-
Critical 9.8
E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_use…
-
Critical 9.8
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterL…
-
High 7.5
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName par…
-
Critical 9.8
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainNa…
-
High 7.5
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the index param…
-
Medium 6.1
Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.
-
High 7.4
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing…
-
High 7.5
Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth…
-
High 7.5
A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reser…
-
Critical 9.8
PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
-
High 7.5
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have …
-
Critical 9.8CVE-2023-25279 EPSS 31%
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a c…
-
High 7.6
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, E…
-
High 7.6
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, E…
-
High 7.6
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, E…
-
High 7.6
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem…