Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 6.3
SourceCodester Billing Management System POST Parameter ajax_service.php sql injection
A vulnerability has been found in SourceCodester Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax_service.php of the component POST Parameter Handler. The manipulation of the…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 5.9
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 6.0
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 4.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 6.5
WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.
-
Medium 5.9
WordPress Team Member Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
-
Medium 5.9
WordPress Simple Custom Author Profiles Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in USB Memory Direct Simple Custom Author Profiles plugin <= 1.0.0 versions.
-
Medium 5.9
WordPress Userlike – WordPress Live Chat plugin Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions.
-
Medium 5.9
WordPress Lazy Social Comments Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Lazy Social Comments plugin <= 2.0.4 versions.
-
Medium 5.9
WordPress Disqus Conditional Load Plugin <= 11.0.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joel James Disqus Conditional Load plugin <= 11.0.6 versions.
-
Medium 6.5
WordPress Vertical scroll recent post Plugin <= 14.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical scroll recent post plugin <= 14.0 versions.
-
Medium 5.9
WordPress Kanban Boards for WordPress Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.
-
Medium 5.9
WordPress WP Content Filter – Censor All Offensive Content From Your Site Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Gwyer WP Content Filter plugin <= 3.0.1 versions.
-
Medium 6.5
WordPress ConvertBox Auto Embed WordPress plugin Plugin <= 1.0.19 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ConvertBox ConvertBox Auto Embed WordPress plugin <= 1.0.19 versions.
-
Medium 5.9
WordPress Read More Without Refresh Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eightweb Interactive Read More Without Refresh plugin <= 3.1 versions.
-
Medium 6.5
WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Rymera Web Co Wholesale Suite plugin <= 2.1.5 versions.
-
Medium 5.9
WordPress TreePress – Easy Family Trees & Ancestor Profiles Plugin <= 2.0.22 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin <= 2.0.22 versions.
-
Medium 6.5
Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and …
-
Medium 5.4
Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation
SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and …
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or mo…
-
Medium 5.0
Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access …
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, re…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or mo…
-
Medium 6.3
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact…
-
Medium 5.5
In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. This could local…
-
Medium 5.5
In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial o…
-
Medium 4.4
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Medium 4.4
In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local de…
-
Medium 4.4
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Medium 4.4
In mlog service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial …
-
Medium 4.4
the apipe driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 4.4
the apipe driver, there is a possible use after free due to a logic error. This could lead to local denial of service w…
-
Medium 4.4
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local deni…
-
Medium 4.4
In log service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial …
-
Medium 4.4
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Medium 4.4
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to loca…
-
Medium 5.5
In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local…
-
Medium 5.5
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no add…