Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
2,424 results · Feed
-
Medium 6.8
Session Fixation in fossbilling/fossbilling
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.
-
High 8.0
Code Injection in fossbilling/fossbilling
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
-
Medium 4.4
NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can config…
-
Critical 9.1
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` …
-
High 7.1
NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allo…
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, whi…
-
Critical 10.0
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights esc…
-
High 7.5
XWiki Platform may show email addresses in clear in REST results
XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has be…
-
Critical 9.9CVE-2023-35150 EPSS 78%
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming r…
-
High 7.5
XWiki Platform may retrieve email addresses of all users
XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, …
-
Medium 6.3
SourceCodester Human Resource Management System detailview.php sql injection
A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The att…
-
Medium 4.3
XWiki Platform's tags on non-viewable pages can be revealed to users
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by t…
-
Critical 10.0
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and vi…
-
Medium 6.2
FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption
FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the performing server do…
-
Critical 9.1
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, a…
-
High 7.5
WordPress MStore API Plugin <= 3.9.7 is vulnerable to SQL Injection
Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.
-
Medium 4.6
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
-
Medium 5.9
WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.
-
Medium 5.9
WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NTZApps CRM Memberships plugin <= 1.6 versions.
-
High 7.1
WordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.
-
Medium 5.9
WordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <= 2.6.2 versions.
-
Medium 5.9
WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin <= 1.2.1 versions.
-
High 7.1
WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.
-
High 7.1
WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor Premium Addons PRO plugin <= 2.8.24 versions.
-
Medium 6.7
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Wind…
-
Low 3.5
Dell BIOS contains an Out-of-bounds Write vulnerability. An unauthenticated physical attacker may potentially exploit t…
-
Medium 6.8
Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exp…
-
High 8.2
Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exp…
-
Medium 6.3
Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on…
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 6.3
SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Game Result Matrix System 1.0. This affects an unknown part of the file /dipam/athlete-profile.php of the component GET Parameter Handler. The manipulation of the argument id leads…