Archive
7 December 2023
Vulnerabilities first published on this day (UTC), newest first.
140 results · Feed
-
Medium 4.3
System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authentica…
-
Medium 6.5
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …
-
Medium 5.9
Business Logic Errors in microweber/microweber
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
-
Unscored —
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
-
Unscored —
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
-
Unscored —
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
-
Unscored —
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementati…
-
Unscored —
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) impleme…
-
Unscored —
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller…
-
Unscored —
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access …
-
Unscored —
Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.
-
High 8.8
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
-
Unscored —
A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via t…
-
Unscored —
TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows atta…
-
Unscored —
A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScrip…
-
Unscored —
Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugi…
-
Unscored —
Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Co…
-
High 7.5
A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exh…
-
Unscored —
Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component.
-
Unscored —
A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhau…
-
Unscored —
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
-
Unscored —
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker …
-
Unscored —
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
-
Unscored —
BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or ke…
-
Unscored —
gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.
-
Unscored —
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
-
Unscored —
Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
-
Unscored —
DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitr…
-
Unscored —
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset ema…
-
Medium 6.1
A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inje…
-
Unscored —
Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_a…
-
High 7.5
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
-
Unscored —
Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.
-
Unscored —
Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_k…
-
Unscored —
Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title para…
-
Unscored —
GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:3…
-
Unscored —
Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. An attacker can use GATT characteristic handle 0x0012 t…
-
Unscored —
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incom…
-
High 7.5
An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input …