Archive
January 2024
Vulnerabilities first published in this month (UTC), newest first.
1,235 results · Clear filters · Feed
-
Medium 6.1
Firefly III allows webhooks HTML Injection.
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
-
Medium 6.1
govuk_tech_docs XSS Vulnerability
govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.
-
Medium 5.3
httparty Multipart/Form-Data Request Tampering Vulnerability
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames bei…
-
Medium 6.1
view_component Cross-site Scripting vulnerability
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component direct…
-
Medium 5.4
Stored XSS in class.upload.php
As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing…
-
Medium 6.9
OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
-
Medium 4.0
Memory corruption issues is Cloudflare zlib implementation
Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could e…
-
Medium 5.7
Rhdh: catalog-import function leaks credentials to frontend
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, inc…
-
Medium 4.5
A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED…
-
Medium 6.4
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitizat…
-
Medium 6.6
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
-
Medium 5.4
PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code', 'pagelayer_body_open_code', and 'pagelayer_footer_code' meta fields in all versions up to, and inclu…
-
Medium 6.5
WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and ab…
-
Medium 4.4
Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for auth…
-
Medium 4.0
Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access…
-
Medium 4.0
Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access…
-
Medium 6.2
Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notific…
-
Medium 4.0
Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 1…
-
Medium 6.8
Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attack…
-
Medium 4.6
Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code …
-
Medium 6.5
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
-
Medium 6.1
ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is no…
-
Medium 6.8
Glitch detection not active by default in Silicon Labs Secure Vault High devices
Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.
-
Medium 6.5
A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an at…
-
Medium 6.8
Aladdin Connect Android Application Insecure Storage
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially ret…
-
Medium 4.8
Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostnam…
-
Medium 6.5
Integer overflow in URI leading to potential host spoofing
Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not a…
-
Medium 5.4
Craft CMS Privilege Escalation
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4…
-
Medium 4.8
CubeFS leaks users key in logs
CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a l…
-
Medium 4.8
CubeFS leaks magic secret key when starting Blobstore access service
CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in pl…
-
Medium 6.5
Insecure random string generator used for sensitive data
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to pre…
-
Medium 6.5
Timing attack can leak user passwords
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case…
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE
TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE plugins
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE
TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
-
Medium 6.5
Authenticated users can crash the CubeFS servers with maliciously crafted requests
CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny o…
-
Medium 6.5
Leverage the kruise-daemon pod to list all secrets in the entire cluster
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemo…
-
Medium 5.4
Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attack…
-
Medium 6.1
Post SMTP < 2.8.7 - Reflected Cross-Site Scripting
The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.