Archive
16 January 2024
Vulnerabilities first published on this day (UTC), newest first.
13 results · Clear filters · Feed
-
Medium 6.5CVE-2024-22411 Public exploit
Cross site scripting in Action messages on Avo
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appear…
-
High 8.8
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exp…
KEV Jan 17, 2024 -
Medium 6.5
Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed…
-
Medium 5.3
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
-
High 7.5CVE-2023-1405 Public exploit
Formidable Forms < 6.2 - Unauthenticated PHP Object Injection
The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
-
Critical 9.8
The School Management < 9.9.7 - Unauthenticated RCE via REST api
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
-
High 7.8
Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on th…
-
Medium 6.3CVE-2011-10005 Public exploit
EasyFTP MKD Command buffer overflow
A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has bee…
-
Critical 10.0
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…
KEV Jan 24, 2024 -
Medium 6.1CVE-2023-48104 Public exploit
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
-
High 7.5CVE-2023-51810 Public exploit
SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain …
-
Medium 6.5CVE-2023-47459 Public exploit
An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryRevie…
-
High 8.8CVE-2023-47460 Public exploit
SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /D…