107,323 results · Clear filters · Feed
-
Medium 4.3
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction his…
-
Medium 6.5
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's…
-
Medium 6.6
BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directo…
-
Medium 5.3
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup jo…
-
Medium 5.3
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's n…
-
Medium 4.3
Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a log…
-
Medium 5.9
BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full …
-
Medium 4.8
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's crea…
-
Medium 4.3
Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access …
-
Medium 6.8
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contribut…
-
Medium 6.9
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local …
-
Medium 6.1
In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerabilit…
-
Medium 6.8
An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow …
-
Medium 6.5
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG UR…
-
Medium 5.4
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_l…
-
Medium 6.9
A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file…
-
Medium 5.4
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines duri…
-
Medium 5.9
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fa…
-
Medium 6.8
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data du…
-
Medium 5.4
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9…
-
Medium 5.4
Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass
A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be ab…
-
Medium 4.3
Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass
A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrie…
-
Medium 6.8
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bou…
-
Medium 5.7
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage…
-
Medium 6.9
A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low…
-
Medium 6.8
A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabr…
-
Medium 6.9
A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions be…
-
Medium 6.0
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fab…
-
Medium 6.8
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS …
-
Medium 4.0
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain a…
-
Medium 5.1
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The inter…
-
Medium 5.1
A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform relea…
-
Medium 6.9
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versi…
-
Medium 6.9
A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions befo…
-
Medium 5.3
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabr…
-
Medium 6.5
NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Imp…
-
Medium 5.9
Potential brute force vulnerability due to non-expiring SMS OTPs
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute …
-
Medium 4.8
GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an …
-
Medium 6.5
libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a m…
-
Medium 5.9
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=E…