Archive
28 July 2023
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
Medium 6.5
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacke…
-
Medium 4.3
Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to …
-
Medium 4.3
Discourse's restricted tag information visible to unauthenticated users
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The i…
-
Medium 5.3
Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper boun…
-
Medium 4.3
Discourse vulnerable to DoS via defer queue
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same…
-
Medium 4.3
Discourse vulnerable to DoS via post edit reason
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.…
-
Medium 6.8
Discourse CSP nonce reuse vulnerability for anonymous users
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP prot…
-
Medium 6.3
Cafe Billing System Order index.php sql injection
A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Order Handler. The manipulation of the argument id leads to sql injection…
-
Medium 6.3
SourceCodester Simple Online Mens Salon Management System sql injection
A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql in…
-
Medium 4.3
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it poss…
-
Medium 4.3
Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various ver…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in Apple Music 4.2.0 for Android. An app may be able …
-
Medium 6.3
phpscriptpoint RecipePoint recipe-result sql injection
A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking_method leads to sql injecti…
-
Medium 4.9
Vault Enterprise Namespace Creation May Lead to Denial of Service
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.