Archive
2 June 2023
Vulnerabilities first published on this day (UTC), newest first.
52 results · Clear filters · Feed
-
Medium 5.4
Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers t…
-
Medium 6.3
Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh…
-
Medium 6.4
Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-…
-
Medium 6.1
Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated …
-
Medium 4.9
Consul Cluster Peering can Result in Denial of Service
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5…
-
Medium 6.3
Campcodes Retro Cellphone Online Store modal_add_product.php sql injection
A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to …
-
Medium 6.3
code-projects Agro-School Management System index.php sql injection
A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument password leads to sql injection. It is possible to launch…
-
Medium 6.3
code-projects Agro-School Management System Attachment Image btn_functions.php unrestricted upload
A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btn_functions.php of the component Attachment Image Handler. The manipulation leads to unrestricted…
-
Medium 6.3
SourceCodester Online Exam Form Submission update_s6.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/update_s6.php. The manipulation of the argument id leads to sql injection. It is possible to initia…
-
Medium 4.9
Prestahop module King-Avis - Path traversal
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
-
Medium 4.3
YFCMF Ajax.php path traversal
A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The …
-
Medium 6.8
Mobatime web application - broken authorisation mechanisms
Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.
-
Medium 4.3
YFCMF index.php path traversal
A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has b…
-
Medium 4.0
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and …
-
Medium 6.1
WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
-
Medium 6.3
Information disclosure, tampering, deletion and destruction vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to …
-
Medium 6.2
Information Disclosure vulnerability in EtherNet/IP Configuration tools
Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71…
-
Medium 6.2
Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded p…
-
Medium 6.5
Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certifi…
-
Medium 6.5
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …
-
Medium 6.5
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certi…
-
Medium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulner…
-
Medium 6.1CVE-2023-33731 Public exploit
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management c…
-
Medium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulner…
-
Medium 5.5
mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory bu…
-
Medium 5.5
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.4
Openfind Mail2000 - XSS (Reflected Cross-site scripting)
Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users ac…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 6.8
ITPison OMICARD EDM - Arbitrary File Upload
OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbit…
-
Medium 4.3
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potent…
-
Medium 6.5
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual l…
-
Medium 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable n…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Medium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…
-
Medium 5.5
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert d…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
Medium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …
-
Medium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in zadam/trilium
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.