Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
1,283 results · Clear filters · Feed
-
Medium 4.3
Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_unset_default_card' function. This makes it possible…
-
Medium 6.4
CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated …
-
Medium 5.3
WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API
The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members …
-
Medium 5.3
WP Private Content Plus <= 3.6 - Protection Mechanism Bypass
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This mak…
-
Medium 4.3
Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure
The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sens…
-
Medium 6.8
Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper …
-
Medium 4.4
powerpc/64s: Fix pte update for kernel memory on radix
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix pte update for kernel memory on radix When adding a PTE a ptesync is needed to order the update of the PTE with subsequent accesses otherwise a spurious fault may be raised. …
-
Medium 4.3
mt76: mt7921: fix memory leak in mt7921_coredump_work
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix memory leak in mt7921_coredump_work Fix possible memory leak in mt7921_coredump_work.
-
Medium 5.5
ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
In the Linux kernel, the following vulnerability has been resolved: ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook The commit 1879445dfa7b ("perf/core: Set event's default ::overflow_handler()") set a default event->overfl…
-
Medium 4.7
i2c: sprd: fix reference leak when pm_runtime_get_sync fails
In the Linux kernel, the following vulnerability has been resolved: i2c: sprd: fix reference leak when pm_runtime_get_sync fails The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove(). However, pm_ru…
-
Medium 4.3
Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset
The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated a…
-
Medium 6.4
Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access…
-
Medium 4.3
Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset
The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with…
-
Medium 6.1
IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…
-
Medium 6.1
Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
-
Medium 5.3
An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the…
-
Medium 6.5
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exi…
-
Medium 4.3
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reade…
-
Medium 4.7
RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.
-
Medium 6.3
An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI …
-
Medium 5.4
An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.
-
Medium 6.5
A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service…
-
Medium 6.5
Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42…
-
Medium 6.5
A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service v…
-
Medium 6.5
A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service v…
-
Medium 6.5
A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of servi…
-
Medium 6.2
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service…
-
Medium 5.4
Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code aft…
-
Medium 6.1
A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attac…
-
Medium 6.1CVE-2024-25202 Public exploit
Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attack…
-
Medium 6.1
F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scr…
-
Medium 6.5CVE-2024-22532 Public exploit
Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service …
-
Medium 4.9
Webtrees Path Traversal vulnerability
Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can navigate beyond the intended directory (the 'media/' directory) to access sensitive files in other …
-
Medium 5.4
An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit invo…
-
Medium 5.3
An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
-
Medium 4.8
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authent…
-
Medium 6.5
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authent…
-
Medium 6.6
A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to cond…
-
Medium 6.6
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…