405,220 results · Feed
-
Medium 5.3
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or A…
-
High 7.5
Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the list…
-
Medium 4.8
Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 a…
-
High 8.8
SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQ…
-
Medium 5.3
The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated…
-
Medium 5.3
The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from b…
-
Medium 5.3
The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its addr…
-
Medium 5.3
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to…
-
Medium 6.7
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticat…
-
High 7.3
Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user …
-
High 7.5
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote …
-
High 7.3
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticat…
-
High 7.5
Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a…
-
High 7.8
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local a…
-
High 7.4
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not h…
-
High 7.0
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFi…
-
High 7.8
Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled Maria…
-
High 7.5
Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode req…
-
High 8.5
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL fu…
-
High 8.5
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of …
-
High 8.5
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function call…
-
Medium 6.6
A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. Thi…
-
Medium 6.8
HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an at…
-
Medium 6.8
HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attac…
-
High 8.8
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnera…
-
Medium 5.3
WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price
The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, includin…
-
Medium 5.3
GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity
The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.
-
Medium 6.5
NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview
The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and…
-
Medium 5.3
ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover…
-
Medium 5.3
Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthent…
-
High 8.8
Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL inje…
-
High 7.7
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to…
-
High 8.1
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via…
-
High 7.2
ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in…
-
High 7.2
ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at…
-
Medium 6.1
Joinchat <= 6.3.1 - Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable
The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output e…
-
High 7.1
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow the…
-
High 8.7
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with inco…
-
Medium 5.3
YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply a…
-
Medium 5.3
Security For WooCommerce <= 1.0.16 - Unauthenticated Server Configuration Information Disclosure
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For …