Archive
6 April 2023
Vulnerabilities first published on this day (UTC), newest first.
15 results · Clear filters · Feed
-
High 8.8
SvelteKit framework has Insufficient CSRF protection for CORS requests
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protecti…
-
High 7.5
Infinite loop in parsing in go/scanner
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
-
High 7.5
Excessive memory allocation in net/http and net/textproto
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…
-
High 7.5
Excessive resource consumption in net/http, net/textproto and mime/multipart
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…
-
High 7.2
Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthentica…
-
High 7.0
Local Privilege Escalation in Cloudflare WARP Installer (Windows)
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, ove…
-
High 7.0
Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An u…
-
High 7.1
WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.
-
High 8.8
SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via…
-
High 8.8
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code vi…
-
High 8.8
SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arb…
-
High 8.8
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code vi…
-
High 7.5
Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote att…
-
High 8.8
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.
-
High 7.8
In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code ex…