Archive
8 November 2023
Vulnerabilities first published on this day (UTC), newest first.
46 results · Clear filters · Feed
-
Medium 5.4
HCL Connections is vulnerable to reflected cross-site scripting
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script cod…
-
Medium 6.7
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker wi…
-
Medium 6.7
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker w…
-
Medium 6.7
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local …
-
Medium 4.4
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may …
-
Medium 6.7
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may a…
-
Medium 4.4
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a loca…
-
Medium 6.7
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated p…
-
Medium 6.7
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with e…
-
Medium 6.7
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated pr…
-
Medium 6.7
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated pr…
-
Medium 6.7
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevate…
-
Medium 6.7
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker…
-
Medium 6.7
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attack…
-
Medium 6.7
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker …
-
Medium 6.7
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker w…
-
Medium 6.7
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local…
-
Medium 6.7
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacke…
-
Medium 6.7
A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker wit…
-
Medium 4.4
A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a lo…
-
Medium 6.7
A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a loc…
-
Medium 6.7
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileg…
-
Medium 6.7
A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local a…
-
Medium 5.5
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.
-
Medium 4.3
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request acc…
-
Medium 5.5
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any fil…
-
Medium 5.0
TIBCO Spotfire Insufficiently Protected Credential vulnerability
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst…
-
Medium 6.5
WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions.
-
Medium 6.5
WordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions.
-
Medium 5.9
WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.
-
Medium 5.9
WordPress Social Feed | All social media in one place Plugin <= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions.
-
Medium 5.9
WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions.
-
Medium 5.9
WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.
-
Medium 6.5
WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions.
-
Medium 5.9
WordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions.
-
Medium 6.4
Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine.
-
Medium 5.9
WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions.
-
Medium 6.5
WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions.
-
Medium 4.8
Group-based JIT MFA bypass on scp and sftp in The Bastion
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not …
-
Medium 5.5
Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.