Archive
July 2024
Vulnerabilities first published in this month (UTC), newest first.
1,322 results · Clear filters · Feed
-
Medium 4.9
Discourse missing authorization checks for suspending admins/moderators
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing t…
-
Medium 4.2
Discourse vulnerable to stored-dom XSS via Facebook Oneboxes
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing malicious…
-
Medium 6.2
Local File Inclusion (LFI) in stitionai/devika
The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently revea…
-
Medium 5.3CVE-2024-31223 Scanner template
Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL whi…
-
Medium 6.5
bt: host/smp: DoS caused by null pointer dereference
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
-
Medium 6.5
XSS in SQL check parameters
Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements
-
Medium 6.3
SourceCodester Online Tours & Travels Management sms_setting.php sql injection
A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_setting.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate …
-
Medium 5.3
Limited DoS due to permitting creating users with user-defined IDs
Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user…
-
Medium 6.4
WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at…
-
Medium 6.4
The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient …
-
Medium 6.4
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attr…
-
Medium 5.9
WPQA < 6.1.1 - Contributor+ Stored XSS
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
-
Medium 6.3
Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group Section
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
-
Medium 6.3
Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
-
Medium 6.5
Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR
The allows any authenticated user to join a private group due to a missing authorization check on a function
-
Medium 6.3
Himer - Social Questions and Answers < 2.1.1 - Contributor+ Stored XSS
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
-
Medium 6.3
Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
-
Medium 4.3
Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery
The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthentic…
-
Medium 5.5
Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segm…
-
Medium 6.3
An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript docume…
-
Medium 5.3
An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a cr…
-
Medium 5.4CVE-2024-39248 Public exploit
A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML vi…
-
Medium 4.3
The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content o…
-
Medium 6.5
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, …
-
Medium 5.4
Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF…
-
Medium 6.3
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with…
-
Medium 5.4
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont …
-
Medium 6.8CVE-2024-37726 Public exploit
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker t…
-
Medium 6.3
itsourcecode Farm Management System sql injection
A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /quarantine.php?id=3. The manipulation of the argument pigno/breed/reason leads to s…
-
Medium 4.4
SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill
SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectname}/skills/{skillname}/video` (and probably others) is open to a cross-site request forgery (CSRF) vulnerability. Due to the endpoint being C…
-
Medium 5.3
aimeos/ai-controller-frontend doesn't reset payment status in basket
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchas…
-
Medium 5.5
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Ai…
-
Medium 5.7
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to …
-
Medium 6.3
linlinjava litemall AdminGoodscontroller.java sql injection
A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection…
-
Medium 6.4
Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8…
-
Medium 4.0
MongoDB C Driver bson_strfreev may be susceptible to integer overflow
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
-
Medium 5.0
Arbitrary Directory Listing in Centrify PAS
Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary directory outside the root directory of the web application. Versions 23.1-HF7 and on have the patch.
-
Medium 6.5
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability ca…
-
Medium 6.8
American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface
Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
-
Medium 6.8
American Dynamics Illustra Essentials Gen 4 - Linux Credential Leak
Under certain circumstances unnecessary user details are provided within system logs