Archive
15 November 2023
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
Medium 5.4
Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery
The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_config function. This makes it possible for unauthenti…
-
Medium 5.3
Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/p…
-
Medium 4.4
Elementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att…
-
Medium 5.4
Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery
The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_elements function. This makes it possible for unauthen…
-
Medium 5.5
ManageEngine Information Disclosure in Multiple Products
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the expose…
-
High 8.2
Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and c…
-
High 7.3
Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows
Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to execute arbitrary code by executing the installer in the same folder as the malicious DLL. This can l…
-
Medium 6.1
Payara Platform: URL Redirection to untrusted site using FORM authentication
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before…
-
Low 2.7
Gotham Video Broken Authentication
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.
-
Medium 5.3
Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle
The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (withi…
-
High 8.8
SQL Injection in Admin Grid Filter API in Pimcore
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned…
-
Medium 6.1
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization accordi…
-
Medium 5.3
pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory
### Impact A client can send reliable-ordered packets 0, 2, 3, 4, 5 ... etc, and all the packets 2 and up will stay in the reliable-ordered queue until 1 arrives. A malicious client can exploit this to waste all available server memory by simply never sending…
-
Unscored —CVE-2023-6112 EPSS 25%
Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit …
-
Unscored —
Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially …
-
Medium 5.5
AVEVA Operations Control Logger External Control of File Name or Path
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
-
High 7.8
AVEVA Operations Control Logger Execution with Unnecessary Privileges
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
-
Unscored —
This module enables you to pay online via Mollie. The module might not properly load the correct order to update the pa…
-
Medium 4.1
Eclipse OpenJ9 possible infinite busy hang
In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.
-
High 7.7
Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system wit…
-
High 7.5
Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.
FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensor…
-
Medium 6.1
Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting
The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…
-
Unscored —
`winx-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`libusb1-main` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`windows-service-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`win_run_rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`registry-win` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`acceptxmr-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`win-base64-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`monero-rpc-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`monero-api` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`win-crypto` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`lasso-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Unscored —
`lfest-main` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user `Kraded` to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the…
-
Low 2.7
DoS via long hostnames
Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
-
High 7.5
In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Rea…
-
High 8.4
Logstash Insertion of Sensitive Information into Log File
An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifestation of this issue are: * Logstash is configured to log in JSON format https://www.elastic.co/guide/…
-
Medium 6.4
Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl…
-
Medium 6.6
Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with admi…
-
Unscored —
Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0…