Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Medium 5.9
WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in M Williams Cab Grid plugin <= 1.5.15 versions.
-
Medium 5.9
WordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions.
-
Medium 5.2
Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian …
-
High 8.1
Second Order Command-injection Vulnerability in the Certificate-delete Function
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which …
-
Medium 4.3CVE-2023-3244 Public exploit
Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for …
-
Medium 6.0
Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC …
-
High 8.1
Second Order Command-injection Vulnerability in the Key-delete Function
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could …
-
Unscored —
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of M…
-
High 7.2
Second Order Command-injection Vulnerability in the Certificate-generation Function
TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which could potentially al…
-
High 8.1
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
-
Low 3.7
Control iD Gerencia Web Cookie cleartext storage
A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may…
-
High 7.2
Second Order Command-injection Vulnerability in the Certificate-generation Function
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, wh…
-
High 8.8
Second Order Command-injection Vulnerability in the Key-generation Function
TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious …
-
High 8.8
Second Order Command-injection Vulnerability in the Key-generation Function
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which coul…
-
Medium 4.7
Permission and Access Control Vulnerability in Some ZTE Mobile Phones
There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.
-
High 7.2
Command-injection Vulnerability in Certificate Management
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, whic…
-
High 8.8
Authentication Bypass Without Administrator Privilege
TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted act…
-
Unscored —
lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.
-
Unscored —
lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/…
-
Unscored —
NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, a…
-
Unscored —
An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the descr…
-
Unscored —
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 se…
-
Unscored —
SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via the …
-
Medium 5.5
Jeecg-boot SQL Injection vulnerability
SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.
-
High 7.5
PowerJob incorrect access control vulnerability
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.
-
Unscored —
File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code…
-
Unscored —
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
Unscored —
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
Unscored —
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of …
-
Unscored —
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
Unscored —
Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbit…
-
Unscored —
File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code…
-
High 7.2
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
High 7.2
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
High 7.2
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…
-
Unscored —
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
-
Medium 5.4
IBM Cognos Analytics server-side request forgey
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attac…
-
Medium 5.3
IBM Cognos Analytics information disclosure
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.
-
Critical 9.9
IBM Security Guardium command execution
IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824.
-
High 7.8
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an …