Archive
18 December 2023
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
High 7.5
WordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
-
High 7.6
WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.
-
High 7.6
WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Pa…
-
High 7.6
WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page – Hit Counter: from n/a through 1.4.14.3.
-
High 8.5
WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
-
High 7.6
WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
-
High 7.5
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory,…
-
High 7.2
WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
-
High 7.2
Quttera Web Malware Scanner < 3.4.2.1 - Admin+ Path Traversal
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
-
High 7.8
Code Injection vulnerability in Cambium ePMP Force 300-25
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…
-
High 7.2
Infinispan: credentials returned from configuration as clear text
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
-
High 7.6
Satellite: arithmetic overflow in satellite
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's inte…
-
High 7.0
Perl: write past buffer end via illegal user-defined unicode property
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
-
High 7.5
Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp
A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and cou…
-
High 7.5
An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthentic…
-
High 7.2
A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative righ…
-
High 7.5
Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
-
High 7.5
ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop…