96,805 results · Clear filters · Feed
-
High 8.5
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL fu…
-
High 7.8
Insufficient IOCTL access control allows local access to arbitrary physical memory
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
-
High 7.8
Insufficient IOCTL access control allows local access to I/O ports
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
-
High 8.8
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnera…
-
High 8.8
Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL inje…
-
High 7.7
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to…
-
High 8.1
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via…
-
High 7.2
ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in…
-
High 7.2
ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at…
-
High 7.1
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow the…
-
High 8.7
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with inco…
-
High 7.5
Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approv…
-
High 7.5
Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its…
-
High 7.5
Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every accou…
-
High 8.8
Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scr…
-
High 8.8
iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR
The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanentl…
-
High 7.5
Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token
The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing s…
-
High 7.1
Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Sit…
-
High 8.8
Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any vi…
-
High 8.8
Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement
The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and ext…
-
High 8.1
Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable
The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be…
-
High 8.1
User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be gr…
-
High 7.0
Akaunting 3.3.0 - Stored XSS through imported item names
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting…
-
High 7.4
pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 7.1
pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). Wh…
-
High 7.4
pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 7.2
Stored XSS in the @waline/client UserList widget via an unescaped commenter link field
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link …
-
High 7.1
LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose particip…
-
High 8.1
node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). Ren…
-
High 7.6
Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or construc…
-
High 7.1
Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userM…
-
High 7.1
Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set …
-
High 8.7
Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. Thi…
-
High 7.1
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version…
-
High 7.5
WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-p…
-
High 8.1
WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem…
-
High 8.1
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthReque…
-
High 7.4
Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can…
-
High 7.8
LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOf…
-
High 8.4
Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentia…