Archive
29 May 2023
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Medium 4.3
Bestwebsoft Relevant Plugin Thumbnail information disclosure
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The a…
-
High 7.7
Insufficiently Protected ChatBot Credentials in tgstation-server
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched i…
-
Medium 4.8
Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job
Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not…
-
High 7.1
WordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.
-
Medium 6.5
WordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions.
-
Medium 4.7
SourceCodester Faculty Evaluation System sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql inje…
-
Medium 4.3
Lack of URL normalization allows rendering previews for disallowed domains
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.
-
Medium 6.3
SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is an unknown function of the file rendered_report.php of the component GET Parameter Handler. The manipulation of the arg…
-
Medium 4.3
WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
-
Medium 5.4
WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.
-
Medium 5.9
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3…
-
Medium 6.4
An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child c…
-
Unscored —
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
-
Medium 4.2
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading co…
-
Unscored —
OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) vi…
-
Medium 6.5
OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a craf…
-
Medium 4.3
OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowin…
-
Unscored —
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial d…
-
Unscored —
OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resou…
-
Unscored —
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
-
Unscored —
OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via c…
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.
-
High 8.8
Dolibarr vulnerable to remote code execution via uppercase manipulation
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
-
Low 3.9
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_writ…
-
Unscored —
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh…
-
Critical 9.8
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL inje…
-
Unscored —CVE-2022-24631 EPSS 41%
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTena…
-
Critical 9.8
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achi…
-
High 7.2
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection…
-
Unscored —
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during …
-
Unscored —
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an …
-
High 7.5CVE-2021-27825 Public exploit
A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-stat…
-
Low 3.7
An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session du…
-
Critical 9.8
In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restri…