Archive
9 June 2023
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
Medium 5.4
Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level …
-
Medium 6.5
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensiti…
-
Medium 6.5
Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to…
-
High 7.2CVE-2023-0992 EPSS 93%
Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil…
-
Medium 4.3
Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification
The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set_featured_image function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, …
-
Medium 4.3
Essential Blocks <= 4.0.6 - Missing Authorization via get
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin …
-
High 7.2
Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection
The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…
-
Medium 4.3
Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice …
-
High 8.8
Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-le…
-
Medium 6.3
SourceCodester Lost and Found Information System manage_user.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is pos…
-
Medium 5.9
An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advance…
-
Critical 9.8
A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large …
-
Medium 5.4
A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code v…
-
Low 3.1CVE-2023-0342 Public exploit
MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
-
High 8.8
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
-
Medium 6.1
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via …
-
Medium 6.1
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via …
-
Medium 5.5
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the d…
-
Medium 5.5
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of servic…
-
Medium 5.5
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service vi…
-
High 7.8
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the data…
-
Medium 5.5
An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by mani…
-
High 7.8
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privile…
-
Medium 5.5
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by m…
-
Medium 6.1
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via …
-
Medium 5.5
An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service …
-
High 7.8
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attac…
-
Medium 5.5
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manip…
-
High 7.8
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by mani…
-
High 7.8
An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks…
-
High 7.1
Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, a…
-
Medium 6.5
Path Traversal in froxlor/froxlor
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
-
Critical 9.8
Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…
-
Medium 5.4
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applie…
-
High 8.8
An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a …
-
High 8.0
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.