Archive
3 June 2024
Vulnerabilities first published on this day (UTC), newest first.
71 results · Clear filters · Feed
-
Medium 6.7
Use After Free in Audio
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
-
Medium 6.7
Use After Free in Audio
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
-
Medium 6.5
Buffer Over-read in WLAN Host
Information disclosure while handling T2LM Action Frame in WLAN Host.
-
Medium 4.4
WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
-
Medium 4.4
WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
-
Medium 5.6
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below,…
-
Medium 5.8
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and b…
-
Medium 4.4
WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.
-
Medium 4.3
WordPress ActiveDEMAND plugin <= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43.
-
Medium 5.9
WordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler.This issue affects Simple Spoiler: from n/a through <= 1.2.
-
Medium 4.1
A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker …
-
Medium 6.0
An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.…
-
Medium 5.2
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, versio…
-
Medium 5.9
WordPress Safety Exit plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS.This issue affects Safety Exit: from n/a through 1.7.0.
-
Medium 5.9
WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through 4.5.
-
Medium 5.9
WordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This issue affects Site Favicon: from n/a through 0.2.
-
Medium 5.9
WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.
-
Medium 6.1
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a f…
-
Medium 5.9
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote au…
-
Medium 6.5
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote au…
-
Medium 6.7
In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…
-
Medium 6.6
In dmc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.6
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local esc…
-
Medium 6.6
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local esca…
-
Medium 4.4
In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local infor…
-
Medium 5.1
In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection estab…
-
Medium 6.5
In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade ch…
-
Medium 5.9
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 4.0
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway JSON Content uploadiscuser.php sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of the file /protocol/iscuser/uploadiscuser.php of the component JSON Content Handler. The manipulation o…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /admin/config_MT.php?action=delete. The manipulation of the argument Mid leads to sql injection. It is…