Archive
23 January 2024
Vulnerabilities first published on this day (UTC), newest first.
71 results · Clear filters · Feed
-
Medium 5.3
Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data
The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number…
-
Medium 4.4
Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for …
-
Medium 5.4
Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series version…
-
Medium 6.1
Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series version…
-
Medium 6.1
Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions up to, and including, 1.0.92.1 due to insufficient input sanitization and output escaping on the exe…
-
Medium 4.0
Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
-
Medium 6.3
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS …
-
Medium 5.9
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. Th…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 a…
-
Medium 5.5
An issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macO…
-
Medium 6.2
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS S…
-
Medium 6.2
The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Pr…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app ma…
-
Medium 6.5
An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPa…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 1…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, …
-
Medium 5.5
An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A lo…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS …
-
Medium 6.5
An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext cop…
-
Medium 5.7
Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, t…
-
Medium 5.5
In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.
-
Medium 6.1
A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attack…
-
Medium 5.4
Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by re…
-
Medium 5.5
Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the …
-
Medium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RD…
-
Medium 5.5
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec…
-
Medium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes,…
-
Medium 5.5
In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and cr…
-
Medium 6.1
Cross-site Scripting in JFinal
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
-
Medium 6.1
Cross-site Scripting in beetl-bbs
Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.
-
Medium 6.1
Cross-site Scripting in JFinal
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.