Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
854 results · Clear filters · Feed
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request …
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forge…
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged requ…
-
Medium 4.3
MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per categor…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive inform…
-
Medium 5.5
fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.
-
Medium 5.5
fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.
-
Medium 6.5
Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows unt…
-
Medium 5.4
SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.
-
Medium 5.4
Business Logic Errors in fossbilling/fossbilling
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 5.4
Business Logic Errors in fossbilling/fossbilling
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 5.4
Insufficient Granularity of Access Control in fossbilling/fossbilling
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 4.6
Missing Authorization in fossbilling/fossbilling
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.
-
Medium 5.5
loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.
-
Medium 6.1
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
-
Medium 6.5CVE-2023-33145 Public exploit
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium 6.6
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
-
Medium 6.5
Microsoft OneNote Spoofing Vulnerability
Microsoft OneNote Spoofing Vulnerability
-
Medium 6.3
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Denial of Service Vulnerability
Microsoft SharePoint Server Denial of Service Vulnerability
-
Medium 6.5
.NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
-
Medium 5.6
Windows DNS Spoofing Vulnerability
Windows DNS Spoofing Vulnerability
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 5.5
Windows Installer Information Disclosure Vulnerability
Windows Installer Information Disclosure Vulnerability
-
Medium 5.3
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 6.5
Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
-
Medium 5.3
DHCP Server Service Information Disclosure Vulnerability
DHCP Server Service Information Disclosure Vulnerability
-
Medium 6.5
Windows Remote Desktop Security Feature Bypass Vulnerability
Windows Remote Desktop Security Feature Bypass Vulnerability
-
Medium 5.5
Azure DevOps Server Spoofing Vulnerability
Azure DevOps Server Spoofing Vulnerability
-
Medium 5.5
Visual Studio Information Disclosure Vulnerability
Visual Studio Information Disclosure Vulnerability
-
Medium 5.5
Sysinternals Process Monitor for Windows Denial of Service Vulnerability
Sysinternals Process Monitor for Windows Denial of Service Vulnerability
-
Medium 6.5
Windows CryptoAPI Denial of Service Vulnerability
Windows CryptoAPI Denial of Service Vulnerability
-
Medium 4.8
Discourse vulnerable to exposure of number of topics recently created in private categories
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently c…
-
Medium 5.4
Discourse Topic Creation Page Allows iFrame Tag without Restrictions
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerabi…
-
Medium 4.1
Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure
The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local clien…
-
Medium 5.9
Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack
Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may…
-
Medium 4.3
Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potenti…
-
Medium 4.1
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow…
-
Medium 5.2
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to…