Archive
21 February 2024
Vulnerabilities first published on this day (UTC), newest first.
64 results · Clear filters · Feed
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS S…
-
Medium 5.3
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3…
-
Medium 5.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
Medium 6.7
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative acces…
-
Medium 4.7
Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation
The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incorrect nonce validation on the install_wpr() function. This makes it possible for unauthenticated atta…
-
Medium 5.3
WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization
The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute_post_data function in all versions up to, and including, 1.3.11. This makes it possible for unauthe…
-
Medium 5.4
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email t…
-
Medium 6.3
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass …
-
Medium 6.5
Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to byp…
-
Medium 6.5
Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out o…
-
Medium 6.5
Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service
The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to chang…
-
Medium 5.3
ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`
## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` **Component**: Cosmos SDK **Criticality**: Medium **Affected** Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8 **Affected** Users: C…
-
Medium 6.5
ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module
## ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module **Component**: Cosmos SDK **Criticality**: Low **Affected Versions**: Cosmos SDK versions <= 0.50.3; <= 0.47.8 **Affected Users**: Chain developers, Validator and Node operators **Impact…
-
Medium 4.4
Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passe…
-
Medium 5.4
An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1…
-
Medium 5.9
An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redir…
-
Medium 6.1
A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code …
-
Medium 4.9
SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web…
-
Medium 6.1CVE-2024-25381 Public exploit
There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.
-
Medium 5.3
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter.
-
Medium 6.3
An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINA…
-
Medium 5.7
Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated mali…
-
Medium 4.3
Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated…