Archive
20 November 2023
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
Medium 5.4
Dev Blog v1.0 - Stored XSS
Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim.
-
Medium 6.5CVE-2023-6199 Public exploit
Book Stack v23.10.2 - LFR via Blind SSRF
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
-
Medium 6.8
An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing applicatio…
-
Medium 6.8
Arbitrary File Write
An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of se…
-
Medium 4.8
Popup Box < 3.7.9 - Admin+ Stored XSS
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
-
Medium 5.4
WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
-
Medium 5.3
next-auth vulnerable to possible user mocking that bypasses basic authentication
NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-…
-
Medium 6.3
Embed Privacy missing escaping for show_all attribute in opt-out shortcode
The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization a…
-
Medium 5.9CVE-2023-48223 Public exploit
fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …
-
Medium 5.3
Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate…
-
Medium 6.5
PowerShell Information Disclosure Vulnerability
PowerShell Information Disclosure Vulnerability
-
Medium 5.4
Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting
The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unau…
-
Medium 6.5
WordPress Slider Revolution Plugin <= 6.6.14 is vulnerable to Cross Site Scripting (XSS)
Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.
-
Medium 4.0
Arkruntime has a buffer overflow vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.
-
Medium 6.2
Cert manager has a use of uninitialized resource vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.
-
Medium 6.2
Liteos-A has a incorrect default permissions vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.
-
Medium 5.9
Arkruntime has a type confusion vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion.
-
Medium 6.2
Arkruntime has a type confusion vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.
-
Medium 5.3
WAGO: Improper Privilege Management in web-based management
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
-
Medium 5.4
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arb…