Archive
26 October 2024
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
High 8.7
GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.
-
High 8.7
GHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 Parser
Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown …
-
High 8.7
GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator
Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any pat…
-
High 8.7
GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.js
Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are ava…
-
High 8.7
GHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2Markdown
HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches …
-
High 8.7
GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.js
Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of tim…
-
High 8.7
GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJS
CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.
-
High 8.7
GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sites
Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.
-
High 8.7
GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane
insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.
-
High 7.5
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenti…
-
High 7.3CVE-2024-9772 Scanner template
Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution
The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate…
-
High 7.2
WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion
The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.6 via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-lev…
-
High 8.8
School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating th…
-
High 7.1
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access g…
-
High 7.8
NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisor…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular us…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular us…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular us…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular us…
-
High 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular us…
-
High 8.2
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to esc…
-
High 8.8CVE-2024-9890 Public exploit
User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass
The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This makes it possible for authenticated attackers, with subscriber…