106,752 results · Clear filters · Feed
-
Medium 4.3
User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely…
-
Medium 6.8
Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts…
-
Medium 6.9
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions a…
-
Medium 6.9
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions a…
-
Medium 6.0
libspdm is a sample implementation that follows the DMTF SPDM specifications. In version 1.4.0, both the FINISH request…
-
Medium 5.0
OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 …
-
Medium 4.4
pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separato…
-
Medium 6.3
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that n…
-
Medium 5.1
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that r…
-
Medium 5.1
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the Elas…
-
Medium 5.3
Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore Co…
-
Medium 5.3
Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::ge…
-
Medium 5.1
Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormat…
-
Medium 5.3
Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescr…
-
Medium 5.1
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integratio…
-
Medium 4.8
Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles(…
-
Medium 4.3
Viber for iOS through 29.4.0.24 Denial of Service via Malformed GIF
Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyExceptio…
-
Medium 4.3
WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=ta…
-
Medium 4.3
WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verifica…
-
Medium 5.4
WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug
WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination…
-
Medium 4.3
1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}
1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding or…
-
Medium 6.1
MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subsc…
-
Medium 4.3
ISE Authorization Bypass vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side valida…
-
Medium 4.6
Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disa…
-
Medium 6.8
Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a…
-
Medium 6.0
Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could …
-
Medium 5.9
Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualiza…
-
Medium 6.0
Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could all…
-
Medium 6.5
An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the …
-
Medium 4.6
An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to …
-
Medium 6.0
Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malici…
-
Medium 5.9
Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicio…
-
Medium 5.9
Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firm…
-
Medium 4.6
Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtua…
-
Medium 4.6
Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervi…
-
Medium 4.0
An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor acces…
-
Medium 5.9
Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV…
-
Medium 5.5
The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the w…
-
Medium 6.5
The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received…
-
Medium 4.3
bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _…