106,954 results · Clear filters · Feed
-
Medium 6.8
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions…
-
Medium 6.1
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted U…
-
Medium 6.1
SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 …
-
Medium 6.1
SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which …
-
Medium 4.8
SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canoni…
-
Medium 5.4
Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword…
-
Medium 5.4
Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierVa…
-
Medium 6.1
SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-con…
-
Medium 6.1
Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin adm…
-
Medium 4.8
Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unes…
-
Medium 4.8
Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which Ex…
-
Medium 6.1
Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-…
-
Medium 5.4
Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a res…
-
Medium 6.5
Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_ev…
-
Medium 6.1
SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printe…
-
Medium 6.1
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Spe…
-
Medium 6.7
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted comman…
-
Medium 5.3
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device ser…
-
Medium 6.3
Authentication bypass by spoofing in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whi…
-
Medium 6.3
Insufficient session expiration in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an …
-
Medium 6.3
Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and una…
-
Medium 5.3
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
-
Medium 6.6
Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
-
Medium 4.9
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
-
Medium 6.4
Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for a…
-
Medium 4.3
Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buff…
-
Medium 6.8
Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials
An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.
-
Medium 6.7
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated at…
-
Medium 5.3
Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM ch…
-
Medium 5.3
PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compu…
-
Medium 5.3
Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, al…
-
Medium 5.3
Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key
The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid…
-
Medium 4.3
URL prefix handling permits API key read-scope bypass in Psono Server
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write…
-
Medium 5.4
User-controlled Duo host permits authenticated SSRF in Psono Server
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to conn…
-
Medium 6.5
WebAuthn assertion replay permits second-factor bypass in Psono Server
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assert…
-
Medium 5.4
File-transfer type confusion permits unauthorized repository writes in Psono Server
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endp…
-
Medium 6.5
Device-code claim permits restricted token escalation in Psono Server
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code …
-
Medium 6.8
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an…
-
Medium 4.8
Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file con…
-
Medium 6.1
DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causin…