Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
1,283 results · Clear filters · Feed
-
Medium 6.4
Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.3.56 due to insufficient input sanitization and output escaping on user supp…
-
Medium 4.3
ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableOptimization function in all versions up to, and including, 3.1.13. This makes it possible for auth…
-
Medium 6.4
Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied link. Th…
-
Medium 4.4
Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings
The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible f…
-
Medium 4.3
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all v…
-
Medium 6.4
Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 4.10.18 due to insufficient input sanitization and output escaping. This makes it possibl…
-
Medium 6.4
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed c…
-
Medium 4.3
ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the enableOptimization function. This makes it poss…
-
Medium 5.3
Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.2 via API. This makes it possible for unauthenticated attackers to obtain post titles, slugs, ID…
-
Medium 6.5
The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which wou…
-
Medium 6.5
Certain HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Information Disclosure
Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back to services enabled by some solutions may have been trusted without the appropriate CA certificate …
-
Medium 4.0
Element Android can be asked to share internal files.
Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data director…
-
Medium 5.9
HCL Domino is susceptible to a weak cryptography vulnerability
Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with ac…
-
Medium 6.1
Unencrypted traffic between pods when using Wireguard and an external kvstore
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue af…
-
Medium 6.1
Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpo…
-
Medium 4.3CVE-2024-24763 Scanner template
JumpServer Open Redirect Vulnerability
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing att…
-
Medium 6.3
Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of t…
-
Medium 5.7
Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset function…
-
Medium 4.5
Decidim vulnerable to possible CSRF attack at questionnaire templates preview
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as yo…
-
Medium 4.3
[20240202] - Core - Open redirect in installation application
Inadequate parsing of URLs could result into an open redirect.
-
Medium 6.1CVE-2024-21725 EPSS 27%
[20240204] - Core - XSS in mail address outputs
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
-
Medium 6.1
[20240203] - Core - XSS in media selection fields
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
-
Medium 6.3
[20240201] - Core - Insufficient session expiration in MFA management views
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
-
Medium 6.5CVE-2024-21726 EPSS 49%
[20240205] - Core - Inadequate content filtering within the filter code
Inadequate content filtering leads to XSS vulnerabilities in various components.
-
Medium 5.9
A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.0…
-
Medium 5.9
A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.0…
-
Medium 4.0
IBM Common Licensing information disclosure
IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
-
Medium 6.5
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's…
-
Medium 6.5
The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and un…
-
Medium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…
-
Medium 6.1
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 4.3
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…
-
Medium 5.3
Liferay Portal and Liferay DXP User Enumeration Vulnerability
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if …
-
Medium 5.3
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity…
-
Medium 5.0
Liferay Portal vulnerable to Denial of Service
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the si…
-
Medium 6.5
Apache DolphinScheduler: Session do not expire after password change
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
-
Medium 6.1
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slas…
-
Medium 6.1CVE-2024-25608 Scanner template
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT C…