Archive
14 May 2024
Vulnerabilities first published on this day (UTC), newest first.
127 results · Clear filters · Feed
-
Medium 4.3
Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure
The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticate…
-
Medium 6.4
WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on…
-
Medium 6.4
Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter
The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes …
-
Medium 4.9
An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protoco…
-
Medium 5.3
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI p…
-
Medium 5.3
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
Medium 5.3
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
Medium 5.3
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PA…
-
Medium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI pro…
-
Medium 6.4
Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and o…
-
Medium 5.3
sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source address
sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e75443…
-
Medium 5.4
WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings
In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality…
-
Medium 4.2
WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController
In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.
-
Medium 6.5
Graphic on-click binding allows unchecked script execution
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted…
-
Medium 6.5
Scrapy allows redirect following in protocols other than HTTP
### Impact Scrapy was following redirects regardless of the URL protocol, so redirects were working for `data://`, `file://`, `ftp://`, `s3://`, and any other scheme defined in the `DOWNLOAD_HANDLERS` setting. However, HTTP redirects should only work between …
-
Medium 4.3
Scrapy's redirects ignoring scheme-specific proxy settings
### Impact When using system proxy settings, which are scheme-specific (i.e. specific to `http://` or `https://` URLs), Scrapy was not accounting for scheme changes during redirects. For example, an HTTP request would use the proxy configured for HTTP and, wh…
-
Medium 5.0
The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerabi…
-
Medium 5.9
An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid…
-
Medium 6.5
The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics fo…
-
Medium 5.9
An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vul…
-
Medium 4.3
Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to pot…
-
Medium 5.9
When importing resources using Web Workers, error messages would distinguish the difference between `application/javasc…
-
Medium 6.1
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…
-
Medium 5.6
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
-
Medium 4.3
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…
-
Medium 6.8
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
-
Medium 5.7
Vulnerable data in transit in GE HealthCare EchoPAC products
Vulnerable data in transit in GE HealthCare EchoPAC products
-
Medium 6.5
Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
-
Medium 5.9
Visual Studio Denial of Service Vulnerability
Visual Studio Denial of Service Vulnerability
-
Medium 6.3
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 5.4
Microsoft Bing Search Spoofing Vulnerability
Microsoft Bing Search Spoofing Vulnerability
-
Medium 5.5
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
-
Medium 5.5
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
Medium 6.5
Windows Deployment Services Information Disclosure Vulnerability
Windows Deployment Services Information Disclosure Vulnerability
-
Medium 5.5
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
-
Medium 6.1
Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
-
Medium 6.5
Azure Migrate Cross-Site Scripting Vulnerability
Azure Migrate Cross-Site Scripting Vulnerability
-
Medium 5.4CVE-2024-30050 EPSS 11%
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
-
Medium 6.8
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
Windows Mobile Broadband Driver Remote Code Execution Vulnerability