Archive
18 January 2024
Vulnerabilities first published on this day (UTC), newest first.
90 results · Feed
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be execu…
-
Medium 6.5
Omission of key-controlled authorization in Qsige
Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locator/quotePrevious/cent…
-
Medium 6.4
WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes …
-
Medium 6.4
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it p…
-
Medium 6.1CVE-2023-6970 Scanner template
WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer
The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…
-
Critical 9.8
Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device'…
-
Medium 4.4
In drm driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 4.4
In autotest driver, there is a possible out of bounds write due to improper input validation. This could lead to local …
-
Medium 5.5
In telephone service, there is a possible improper input validation. This could lead to local information disclosure wi…
-
Medium 4.4
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 4.4
In vsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 4.4
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial o…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local de…
-
Medium 4.4
In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with…
-
Medium 5.5
In video decoder, there is a possible improper input validation. This could lead to local denial of service with no add…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 4.4
In media service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local de…
-
Medium 4.4
In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with Syste…
-
Medium 5.5
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local den…
-
Medium 5.5
Novel-Plus list sql injection
A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has be…
-
Medium 5.0CVE-2023-6184 EPSS 47%
Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
-
Medium 5.3
DeepFaceLab Util.py deserialization
A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the file mainscripts/Util.py. The manipulation leads to deserialization. Local access is required to approa…
-
Low 3.5
PHPGurukul Company Visitor Management System search-visitor.php cross site scripting
A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file search-visitor.php. The manipulation leads to cross site scripting. The attack ma…
-
Medium 5.3
Karjasoft Sami HTTP Server HTTP HEAD Rrequest denial of service
A vulnerability was found in Karjasoft Sami HTTP Server 2.0. It has been classified as problematic. Affected is an unknown function of the component HTTP HEAD Rrequest Handler. The manipulation leads to denial of service. It is possible to launch the attack r…
-
Medium 6.3
PHPGurukul Company Visitor Management System search-visitor.php sql injection
A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file search-visitor.php. The manipulation leads to sql injection. The attack can…
-
High 7.5
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST reques…
-
High 8.8
An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitra…
-
Medium 5.5
A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token f…
-
Medium 5.4
Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's nam…
-
High 8.8
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
-
High 8.8
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save