Archive
21 September 2024
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
Medium 4.4
MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authent…
-
Medium 5.3
MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to …
-
Medium 6.5
MXview One Series vulnerable to Path Traversal
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT si…
-
Medium 5.5
MXview One and MXview One Central Manager Series store cleartext credentials in a local file
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.