Archive
4 January 2024
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Medium 6.1
govuk_tech_docs XSS Vulnerability
govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.
-
Medium 5.3
httparty Multipart/Form-Data Request Tampering Vulnerability
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames bei…
-
Medium 6.1
view_component Cross-site Scripting vulnerability
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component direct…
-
Medium 5.4
Stored XSS in class.upload.php
As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing…
-
Medium 6.9
OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
-
Medium 4.0
Memory corruption issues is Cloudflare zlib implementation
Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could e…
-
Medium 5.7
Rhdh: catalog-import function leaks credentials to frontend
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, inc…
-
Medium 4.5
A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED…
-
Medium 6.4
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitizat…
-
Medium 6.6
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
-
Medium 5.4
PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and inclu…
-
Medium 6.5
WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and ab…
-
Medium 4.4
Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for auth…
-
Medium 4.0
Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access…
-
Medium 4.0
Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access…
-
Medium 6.2
Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notific…
-
Medium 4.0
Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 1…
-
Medium 6.8
Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attack…
-
Medium 4.6
Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code …
-
Medium 6.5
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
-
Medium 6.1
ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is no…