Archive
7 November 2023
Vulnerabilities first published on this day (UTC), newest first.
95 results · Clear filters · Feed
-
Medium 6.4
Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…
-
Medium 6.4
Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i…
-
Medium 6.4
Interact: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user…
-
Medium 6.4
Gift Up Gift Cards for WordPress and WooCommerce <= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping …
-
Medium 6.4
Featured Image Caption <= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attr…
-
Medium 5.3
Apache OFBiz: Execution of Solr plugin queries without authentication
Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09
-
Medium 6.1
ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmap_save_area_title' function. This makes it possible for unauthenticated…
-
Medium 6.4
ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f…
-
Medium 6.4
WP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…
-
Medium 4.3
ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to updat…
-
Medium 5.4
ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax
The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subsc…
-
Medium 6.4
Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attribu…
-
Medium 6.3
Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers…
-
Medium 5.4
Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass aut…
-
Medium 4.0
Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read s…
-
Medium 4.4
Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 …
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to versio…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prio…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prio…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account pri…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account p…
-
Medium 5.5
Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 1…
-
Medium 5.5
Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files.
-
Medium 6.2
Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows at…
-
Medium 4.0
Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access …
-
Medium 4.0
Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitiv…
-
Medium 4.7
PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows lo…
-
Medium 5.9
An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to…
-
Medium 6.3
Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to re…
-
Medium 6.6
Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execu…
-
Medium 5.9
Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the net…
-
Medium 6.2
Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass …
-
Medium 6.7
Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi a…
-
Medium 6.7
Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitr…
-
Medium 6.7
Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows loca…
-
Medium 5.6
Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local …
-
Medium 6.7
Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to ex…
-
Medium 6.4
Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode
The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for auth…
-
Medium 4.5CVE-2023-38549 EPSS 19%
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acqu…