Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 4.3
meitar Inline Google Spreadsheet Viewer Plugin inline-gdocs-viewer.php displayShortcode cross-site request forgery
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-si…
-
Medium 6.5
Windows Local Security Authority (LSA) Denial of Service Vulnerability
Windows Local Security Authority (LSA) Denial of Service Vulnerability
-
Medium 5.5
Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
-
Medium 6.7
Unified Write Filter Elevation of Privilege Vulnerability
Unified Write Filter Elevation of Privilege Vulnerability
-
Medium 5.9
Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
-
Medium 6.5
gpt_academic's Configuration File vulnerable to File Information Disclosure
gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to infor…
-
Medium 6.1
Formcreator vulnerable to stored XSS from ##FULLFORM##
Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FUL…
-
Medium 6.3
SourceCodester Lost and Found Information System access control
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can…
-
Medium 6.3
yiwent Vip Video Analysis title.php server-side request forgery
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. Th…
-
Medium 4.6
In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible
-
Medium 5.3
In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive accoun…
-
Medium 4.6CVE-2023-34225 EPSS 61%
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible
-
Medium 5.3
In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks
-
Medium 4.3
In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some …
-
Medium 4.8
In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible
-
Medium 4.3
In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit B…
-
Medium 4.6CVE-2023-34220 EPSS 61%
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
-
Medium 6.5
ningzichun Student Management System Password Reset resetPassword.php password recovery
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument …
-
Medium 6.3
SourceCodester Simple Chat System POST Parameter sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=read_msg of the component POST Parameter Handler. The manipulation of…
-
Medium 6.3
SourceCodester Train Station Ticketing System GET Parameter manage_prices.php sql injection
A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_prices.php of the component GET Parameter Handler. The manipulation of the arg…
-
Medium 5.4
Algernon engine and themes vulnerable to Cross-site Scripting
All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization…
-
Medium 6.4
Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it po…
-
Medium 4.4
CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit…
-
Medium 6.4
Display post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it…
-
Medium 4.4
Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p…
-
Medium 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability chec…
-
Medium 5.5
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when c…
-
Medium 6.1CVE-2023-33732 Public exploit
Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 al…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence a…
-
Medium 5.4
Dcat-Admin vulnerable to Stored Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
-
Medium 5.4CVE-2023-31548 Scanner template
A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows atta…
-
Medium 5.5
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again f…
-
Medium 5.3
NULL Pointer Dereference in gpac/gpac
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
-
Medium 4.1
Cross-site Scripting (XSS) - Stored in mkucej/i-librarian-free
Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
-
Medium 4.4
Unchecked Return Value in gpac/gpac
Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
-
Medium 6.0
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
-
Medium 6.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.