Archive
14 November 2023
Vulnerabilities first published on this day (UTC), newest first.
135 results · Clear filters · Feed
-
Medium 5.0
Generic Extractor MITM Vulnerability in yt-dlp
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP sessio…
-
Medium 5.3
A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings.…
-
Medium 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via netw…
-
Medium 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information d…
-
Medium 4.3
An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulne…
-
Medium 5.5
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged pers…
-
Medium 6.3
Hub: insecure galaxy-importer tarfile extraction
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritt…
-
Medium 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of ser…
-
Medium 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network acces…
-
Medium 4.3
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow a…
-
Medium 6.2
ASP.NET Core Security Feature Bypass Vulnerability
ASP.NET Core Security Feature Bypass Vulnerability
-
Medium 5.8
WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.
-
Medium 5.9
WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions.
-
Medium 5.8
WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions.
-
Medium 5.9
WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.
-
Medium 5.9
WordPress Forms for Mailchimp by Optin Cat Plugin <= 2.5.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin <= 2.5.4 versions.
-
Medium 6.4
Insecure Use of HMAC-SHA1 For Session Signing in datahub
DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources (i.e. state level actors wit…
-
Medium 5.9
WordPress OneClick Chat to Order Plugin <= 1.0.4.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Walter Pinem OneClick Chat to Order plugin <= 1.0.4.2 versions.
-
Medium 5.3
Request smuggling in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…
-
Medium 6.8
WordPress EazyDocs Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability on 302 response page in spider-themes EazyDocs plugin <= 2.3.3 versions.
-
Medium 4.7CVE-2023-47125 Public exploit
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vuln…
-
Medium 5.9
WordPress Actueel Financieel Nieuws – Denk Internet Solutions Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DenK BV Actueel Financieel Nieuws – Denk Internet Solutions plugin <= 5.1.0 versions.
-
Medium 5.9
WordPress Recently viewed and most viewed products Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vulnerability in CedCommerce Recently viewed and most viewed products plugin <= 1.1.1 versions.
-
Medium 4.2
Weak Authentication in Session Handling in typo3/cms-core
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for…
-
Medium 6.7
Improper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an auth…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may all…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an a…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 ma…
-
Medium 6.7
Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 m…
-
Medium 4.1
Non-Transparent Sharing of Microarchitectural Resources in some Intel(R) NUC BIOS firmware may allow a privileged user …
-
Medium 4.6
Out-of-bounds read in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially ena…
-
Medium 6.8
Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version…
-
Medium 5.3
Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable infor…
-
Medium 6.7
Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authentic…
-
Medium 6.7
Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow …
-
Medium 6.7
Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenti…
-
Medium 6.7
Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potent…
-
Medium 4.3
Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVI…
-
Medium 5.3
Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may all…
-
Medium 5.5
Improper access control in the Intel Support android application all verions may allow an authenticated user to potenti…