Archive
2 May 2023
Vulnerabilities first published on this day (UTC), newest first.
29 results · Clear filters · Feed
-
Medium 4.4
Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * re…
-
Medium 4.4
@mittwald/kubernetes's secret contents leaked via debug logging
### Impact When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources. When running in a Kubernetes cluster, this might expose sens…
-
Medium 4.9
Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers…
-
Medium 4.3
Rebuild cross-site request forgery
A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and …
-
Medium 4.3
Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexity
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algo…
-
Medium 5.9
WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
-
Medium 5.4
Unrestricted navigation due to unvalidated mattermost server redirection
Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
-
Medium 4.4
Automation user secret logged to Apache access log
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
-
Medium 6.1CVE-2023-1546 Scanner template
MyCryptoCheckout < 2.124 - Reflected XSS
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
-
Medium 4.3
Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
-
Medium 4.8
WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed …
-
Medium 4.8
WP Custom Author URL < 1.0.5 - Admin+ Stored XSS
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowe…
-
Medium 5.4
Stagtools < 2.3.7 - Contributor+ Stored XSS
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cr…
-
Medium 6.1
Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users suc…
-
Medium 6.1
Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users suc…
-
Medium 6.5
Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
-
Medium 4.8
Amr Ical Events Lists <= 6.6 - Admin+ Stored XSS
The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowe…
-
Medium 4.8
Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disal…
-
Medium 5.4CVE-2023-1861 EPSS 29%
Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
-
Medium 4.8
Site Reviews < 6.7.1 - Admin+ Stored XSS
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e…
-
Medium 6.7
Improper validation of array index in computer vision.
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
-
Medium 5.4CVE-2023-29918 Public exploit
RosarioSIS vulnerable to CSV Injection
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
-
Medium 6.5
Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and custo…
-
Medium 5.2CVE-2023-29772 EPSS 11%
A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC…
-
Medium 6.5
Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information …
-
Medium 5.4CVE-2023-31434 Public exploit
The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in …
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Medium 5.6
Moodle: minor sql injection risk in external wiki method for listing pages
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL comman…
-
Medium 6.5
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of da…