status: affected

ecosystem: software/application

metric_type: Primary

severity: critical

part: a

product: masacms

vendor: masacms

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.

title: Masacms security vulnerability


metric_type: Secondary

vendor: murasoftware

summary: A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.

title: Murasoftware Mura Cms security vulnerability


severity: medium

product: binutils

vendor: gnu

summary: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

title: Gnu Binutils security vulnerability


summary: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

title: Gnu Binutils security vulnerability


summary: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

title: Gnu Binutils security vulnerability


summary: An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

title: Gnu Binutils security vulnerability


severity: high

product: dynamips

vendor: solarwinds

summary: Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.


product: mariadb

vendor: mariadb

summary: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.


product: opusfile

vendor: xiph

part: o

product: fedora

vendor: fedoraproject

summary: A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.

title: Xiph Opusfile security vulnerability


product: hwloc

vendor: open-mpi

summary: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c.

title: Open-Mpi Hwloc security vulnerability


product: vim

vendor: vim

summary: A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.

title: Vim security vulnerability


vendor: timmystudios

summary: Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.

title: Timmystudios Fast Typing Keyboard security vulnerability


vendor: actionlauncher

summary: An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert.

title: Actionlauncher Action Launcher security vulnerability


summary: An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update.


archetype: generic

product: playsms

vendor: playsms

summary: A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.


ecosystem: operating-system

vendor: dlink

summary: Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.

title: Dlink Dir-825 Firmware security vulnerability


default_status: unknown

vendor: siklu

version_type: custom

status: Deferred

summary: Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware, which would typically be used with firmware 2.1.1 or later.

title: Siklu Tg Terragraph security vulnerability


summary: Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.


vendor: askey

summary: An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80.

title: Askey Rtf3505Vw-N1 Firmware security vulnerability


product: mcms

vendor: mingsoft

summary: MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.


vendor: netgear

summary: The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware versions: V1.1.0.112_1.0.1, V1.1.0.114_1.0.1.

title: Netgear Ac1200 R6220 Firmware security vulnerability


product: dotnetnuke

vendor: dnnsoftware

summary: An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.

title: Dnnsoftware Dotnetnuke security vulnerability


vendor: trendnet

summary: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

title: Trendnet Tew-820Ap Firmware security vulnerability


summary: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp. NOTE: the Supplier has found that this is not a buffer overflow; at most an out-of-bounds read can occur.

title: 7-Zip P7Zip security vulnerability


summary: NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information.


summary: In NVS365 V01, the background network test function can trigger command execution.


vendor: sparxsystems

summary: SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box..

title: Sparxsystems Enterprise Architect security vulnerability


summary: A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter.

title: Small Crm Project Small Crm security vulnerability


product: smartoffice

vendor: smartofficepayroll

summary: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

title: Smartofficepayroll Smartoffice security vulnerability


summary: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.


product: spitfire

summary: A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary code via sending crafted requests to the web application.

title: Spitfire Project Spitfire security vulnerability


product: ostree

summary: An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print_panic function in repo_checkout_filter.rs.

title: Ostree Project Ostree security vulnerability


product: gpac

vendor: gpac

summary: GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow via gf_vvc_read_sps_bs_internal function of media_tools/av_parsers.c


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tile_columns

title: GPAC MP4box security vulnerability


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf_text_process_sub function of filters/load_text.c


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316

title: Gpac security vulnerability


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap use-after-free via filters/dmx_m2ts.c:470 in m2tsdmx_declare_pid


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx_m2ts.c:343 in m2tsdmx_declare_pid


summary: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc_parse_vps_extension function of media_tools/av_parsers.c


vendor: sengled

summary: A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame.

title: Sengled Es21-N1Eaw Firmware security vulnerability


vendor: phpgurukul

summary: A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.

title: Phpgurukul Student Study Center Management System security vulnerability


vendor: jeecg

summary: Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.


vendor: tenda

summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.


summary: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.


product: phpok

vendor: phpok

summary: PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.


vendor: creativeitem

summary: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.

title: Creativeitem Academy Lms security vulnerability


summary: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.


summary: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.


default_status: unaffected

product: Gallery Metabox

vendor: Bill Erickson

summary: Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.


product: Chronoforms

product: chronoforms

vendor: chronoengine

summary: Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.


vendor: WPManageNinja LLC

status: unaffected

ecosystem: php/wordpress

vendor: wpmanageninja

summary: Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.

title: Wpmanageninja Ninja Tables security vulnerability


product: Ninja Tables

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <= 4.3.4 versions.


product: LOGIN AND REGISTRATION ATTEMPTS LIMIT

vendor: German Krutov

summary: Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.


product: WP Basic Elements

vendor: Damir Calusic

summary: Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.


product: ARMember

vendor: Repute InfoSystems

product: armember

vendor: reputeinfosystems

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.

title: Reputeinfosystems Armember security vulnerability


product: WP Dynamic Keywords Injector

vendor: Seerox

vendor: seerox

summary: Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <= 2.3.15 versions.


product: Mediamatic – Media Library Folders

vendor: Plugincraft

vendor: mediamatic

summary: Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.


product: Multiple Page Generator Plugin – MPG

vendor: Themeisle

vendor: themeisle

summary: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG plugin <= 3.3.9 versions.


product: mediamatic

vendor: frenify

title: Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions


vendor: Blockonomics

product: blockonomics

vendor: blockonomics

summary: Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.


product: Real Estate 7 WordPress

vendor: Contempoinc

vendor: contempothemes

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.

title: Contempothemes Real Estate 7 security vulnerability


product: ipBlockList

vendor: Kesz1 Technologies

product: ipblocklist

summary: Cross-Site Request Forgery (CSRF) vulnerability in Kesz1 Technologies ipBlockList plugin <= 1.0 versions.


vendor: WP Overnight

vendor: wpovernight

summary: Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.

title: Wpovernight Woocommerce Pdf Invoices& Packing Slips security vulnerability


product: Pretty Links

vendor: Pretty Links

vendor: upress

summary: Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.


product: WooCommerce Conversion Tracking

vendor: weDevs

summary: Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery. This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.10.


vendor: JS Help Desk

vendor: joomsky

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

title: Joomsky Js Help Desk security vulnerability


product: ClickFunnels

vendor: Etison, LLC

product: clickfunnels

vendor: clickfunnels

summary: Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <= 3.1.1 versions.


product: Jobeleon Theme

vendor: WPJobBoard

product: jobeleon

vendor: wpjobboard

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue affects Jobeleon Theme: from n/a through 1.9.1.

title: Wpjobboard Jobeleon security vulnerability


vendor: Pi Websolution

ecosystem: javascript/npm

vendor: piwebsolution

summary: Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4.49 versions.

title: Piwebsolution Css Js Manager, Async Javascript, Defer Render Blocking C… security vulnerability


product: Slider by Supsystic

vendor: Supsystic

product: slider

vendor: supsystic

summary: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin <= 1.8.5 versions.


product: WP Custom Fields Search

vendor: Don Benjamin

vendor: webhammer

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Don Benjamin WP Custom Fields Search plugin <= 1.2.34 versions.

title: Webhammer Wp Custom Fields Search security vulnerability


product: alfred24 Click & Collect

vendor: Pakpobox

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions.

title: Alfred24 Click & Collect Project Alfred24 Click & Collect security vulnerability


product: Logaster Logo Generator

vendor: Logaster

vendor: logaster

summary: Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <= 1.3 versions.


vendor: Wpmet

vendor: wpmet

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Login and Register Social Counter: from n/a through 1.9.0.

title: Wpmet Wp Social Login And Register Social Counter security vulnerability


product: Health Check & Troubleshooting

vendor: The WordPress.org community

vendor: wordpress

summary: Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.


product: DH – Anti AdBlocker

vendor: Dannie Herdyawan

summary: Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin <= 36 versions.


product: WP CSV to Database – Insert CSV file content into WordPress database

vendor: Tips and Tricks HQ, josh401

severity: low

summary: Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions.

title: Wp Csv To Database Project Wp Csv To Database security vulnerability


vendor: MagePeople Team

vendor: mage-people

summary: Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.

title: Mage-People Event Manager And Tickets Selling Plugin For Woocommerce security vulnerability


product: CoSchedule

vendor: CoSchedule

product: coschedule

vendor: coschedule

summary: Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.


vendor: voidCoders

vendor: voidcoders

summary: Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.

title: Voidcoders Void Contact Form 7 Widget For Elementor Page Builder security vulnerability


product: Crayon Syntax Highlighter

vendor: Aram Kocharyan

summary: Cross-Site Request Forgery (CSRF) vulnerability in Aram Kocharyan Crayon Syntax Highlighter plugin <= 2.8.4 versions.


product: Printful Integration for WooCommerce

vendor: printful

summary: Missing Authorization vulnerability in printful Printful Integration for WooCommerce printful-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through <= 2.2.3.

title: Printful Printful Integration For Woocommerce security vulnerability


product: Visibility Logic for Elementor

vendor: StaxWP

vendor: staxwp

summary: Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.


vendor: Unlimited Elements

vendor: unlimited-elements

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.

title: Unlimited-Elements Unlimited Elements For Elementor security vulnerability


product: IP Vault – WP Firewall

vendor: Paul C. Schroeder

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin <= 1.1 versions.


product: ShopLentor

vendor: HasThemes

vendor: hasthemes

summary: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.


vendor: nasirahmed

vendor: advancedformintegration

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.

title: Advancedformintegration Advanced Form Integration security vulnerability


product: Performance Lab

vendor: WordPress Performance Team

vendor: wordpress

summary: Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions.


product: Royal Elementor Addons and Templates

vendor: P Royal

vendor: royal-elementor-addons

summary: Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.


product: Depicter Slider

vendor: Depicter Slider and Popup by Averta

vendor: averta

summary: Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.

title: Averta Depicter Slider security vulnerability


product: WP EasyPay – Square for WordPress

vendor: WP Easy Pay

vendor: wpeasypay

summary: Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.


product: Simple Share Buttons Adder

vendor: Simple Share Buttons

vendor: simplesharebuttons

summary: Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions.


product: OWM Weather

vendor: Uwe Jacobs

vendor: ujsoftware

summary: Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.


product: Kopa Framework

vendor: Kopa Theme

vendor: kopatheme

summary: Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <= 1.3.5 versions.


vendor: wpexpertsio

vendor: wpexperts

summary: Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.

title: Wpexperts Email Templates Customizer And Designer security vulnerability


product: APIExperts Square for WooCommerce

vendor: Wpexpertsio

summary: Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.

title: Wpexpertsio Apiexperts Square For Woocommerce security vulnerability


vendor: StylistWP

product: stylist

summary: Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <= 0.2.6 versions.

title: Stylist Project Stylist security vulnerability


product: Apache Traffic Server

vendor: Apache Software Foundation

vendor: apache

vendor: debian

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

title: Apache Traffic Server security vulnerability


version_type: semver

summary: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.


product: UPS CS141

vendor: Generex

vendor: generex

summary: There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.


summary: There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.


summary: There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.


summary: Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.

title: Generex Cs141 Firmware security vulnerability


summary: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.


summary: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.


summary: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.


product: Ghost

vendor: Ghost Foundation

product: ghost

vendor: ghost

summary: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user.


summary: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.


summary: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.


summary: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.


product: NETGEAR Nighthawk WiFi6 Router

version: NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90

vendor: netgear

summary: The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.


summary: A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.


summary: The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.


platforms:
32-bit Systems
x64-based Systems

product: Microsoft 365 Apps for Enterprise

vendor: Microsoft

ecosystem: windows/system

vendor: microsoft

summary: Microsoft Office Graphics Remote Code Execution Vulnerability


title: Microsoft Office Graphics Remote Code Execution Vulnerability


product: Dataprobe iBoot-PDU FW

vendor: Dataprobe, Inc.

vendor: dataprobe

summary: A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.


product: V-Server

vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.

version: v4.0.12.0 and earlier

product: v-server

vendor: fujielectric

summary: Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.

title: Fujielectric V-Server security vulnerability


product: ruby-git

vendor: ruby-git

version: versions prior to v1.13.0

product: fedora

vendor: fedoraproject

summary: ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.

title: Ruby-Git Project Ruby-Git security vulnerability


summary: The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.


vendor: Unisoc (Shanghai) Technologies Co., Ltd.

product: android

vendor: google

summary: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.


title: In wlan driver, there is a possible missing params check


summary: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.


title: In wlan driver, there is a possible missing permission check


summary: In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.


summary: In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.


summary: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.


title: In telecom service, there is a missing permission check


summary: In media service, there is a missing permission check. This could lead to local denial of service in media service.


summary: In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.


summary: In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.


summary: In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.


summary: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.


title: In engineermode services, there is a missing permission check


summary: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed


title: In camera driver, there is a possible out of bounds read due to a missing bounds check


summary: In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed

title: Google Android security vulnerability


summary: In log service, there is a missing permission check. This could lead to local denial of service in log service.


title: In log service, there is a missing permission check


summary: In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.


summary: In wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services.


summary: In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.


title: In wlan driver, there is a possible out of bounds write due to a missing bounds check


summary: In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.


summary: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.


summary: In bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel.


product: Pandora FMS

vendor: Artica PFMS

vendor: pandorafms

summary: Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload.


summary: Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.


product: SIMATIC PC-Station Plus

vendor: Siemens

version: All versions

product: SIMATIC S7-400 CPU 412-2 PN V7

product: SIMATIC S7-400 CPU 414-3 PN/DP V7

product: SIMATIC S7-400 CPU 414F-3 PN/DP V7

product: SIMATIC S7-400 CPU 416-3 PN/DP V7

product: SIMATIC S7-400 CPU 416F-3 PN/DP V7

product: SINAMICS S120 (incl. SIPLUS variants)

version: All versions < V5.2 SP3 HF15

product: SIPLUS S7-400 CPU 414-3 PN/DP V7

product: SIPLUS S7-400 CPU 416-3 PN/DP V7

vendor: siemens

summary: A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle HTTP(S) requests to the web server correctly. This could allow an attacker to exhaust system resources and create a denial of service condition for the device.

title: Siemens 6Es7412-2Ek07-0Ab0 Firmware security vulnerability


summary: A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle long file names correctly. This could allow an attacker to create a buffer overflow and create a denial of service condition for the device.


product: Alaris Infusion Central

vendor: bd

summary: The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.


product: SICK SIM2000ST (LFT PPC)

version: Partnumber 2086502 with firmware version < 1.13.4

vendor: sick

summary: Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).

title: Sick Sim2000 Firmware security vulnerability


product: CODESYS Control RTE (SL)

vendor: CODESYS

product: CODESYS Control RTE (for Beckhoff CX) SL

product: CODESYS Control Win (SL)

product: CODESYS Control Runtime System Toolkit

product: CODESYS Safety SIL2 Runtime Toolkit

product: CODESYS Safety SIL2 PSP

product: CODESYS HMI (SL)

product: CODESYS Development System V3

product: CODESYS Control for BeagleBone SL

product: CODESYS Control for emPC-A/iMX6 SL

product: CODESYS Control for IOT2000 SL

product: CODESYS Control for Linux SL

vendor: codesys

status: Analyzed

summary: Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.


summary: An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.

title: Codesys Control For Beaglebone Sl security vulnerability


summary: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.


summary: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.


summary: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.


summary: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.


product: CODESYS Edge Gateway for Windows

product: CODESYS Gateway

summary: In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.


summary: An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.


summary: An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.


product: RTLS Studio

vendor: Sewio

vendor: sewio

summary: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.

title: Sewio Real-Time Location System Studio security vulnerability


summary: An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.

title: Change Password For Frontend Users Project Change Password For Frontend… security vulnerability


product: master-quiz

summary: An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.


summary: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.

title: Fp Newsletter Project Fp Newsletter security vulnerability


summary: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.


summary: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.


summary: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.


product: Workspace

vendor: ONLYOFFICE

product: workspace

vendor: onlyoffice

summary: Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.

title: Onlyoffice Workspace security vulnerability


default_status: affected

product: OpenKM

vendor: OpenKM

product: openkm

vendor: openkm

summary: Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.


summary: If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.

title: Openkm security vulnerability


product: LogicalDOC Enterprise

vendor: LogicalDOC

product: LogicalDOC Community Edition

product: logicaldoc

vendor: logicaldoc

summary: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).

title: Logicaldoc security vulnerability


summary: LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system.


summary: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.

title: Logicaldoc security vulnerability


summary: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.

title: Logicaldoc security vulnerability


product: Mayan EDMS

vendor: Mayan EDMS

vendor: mayan-edms

summary: An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.


product: Accessibility Suite by Online ADA

vendor: Online ADA

vendor: adaplugin

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.12.

title: Adaplugin Accessibility Suite By Online Ada security vulnerability


product: ARMember (free)

vendor: Repute InfoSystems

product: ARMember (premium)

product: armember

vendor: armemberplugin

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.

title: Armemberplugin Armember security vulnerability


product: Accept Stripe Donation – AidWP

vendor: HM Plugin

vendor: hmplugin

summary: Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions.


product: WP-dTree

vendor: Ulf Benjaminsson

product: wp-dtree

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.

title: Wp-Dtree Project Wp-Dtree security vulnerability


product: ARMember

product: ARMember Premium

vendor: reputeinfosystems

summary: Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.

title: Reputeinfosystems Armember security vulnerability


vendor: Repute Infosystems

summary: Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.


product: Neshan Maps

vendor: Neshan Maps Platform

vendor: neshan

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.

title: Neshan Neshan Maps security vulnerability


product: My Calendar

vendor: Joseph C Dolson

summary: Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.


vendor: WpDevArt

vendor: wpdevart

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.

title: Wpdevart Booking Calendar security vulnerability


vendor: 8Degree Themes

summary: Missing Authorization vulnerability in 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin allows Retrieve Embedded Sensitive Data.This issue affects Coming Soon Landing Page and Maintenance Mode WordPress Plugin: from n/a through 2.2.0.

title: 8Degree Themes Coming Soon Landing Page And Maintenance Mode Wordpress… security vulnerability


vendor: Weblizar

vendor: weblizar

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Management – Education & Learning Management: from n/a through 4.1.

title: Weblizar School Management - Education & Learning Management security vulnerability


product: Open RDW kenteken voertuiginformatie

vendor: Tussendoor internet & marketing

vendor: tussendoor

summary: Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.

title: Tussendoor Open Rdw Kenteken Voertuiginformatie security vulnerability


product: Shortcode IMDB

vendor: Kemal YAZICI - PluginPress

vendor: kemalyazici

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Injection.This issue affects Shortcode IMDB: from n/a through 6.0.8.

title: Kemalyazici Shortcode Imdb security vulnerability


product: Multi Rating

vendor: Daniel Powney

vendor: danielpowney

summary: Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.

title: Danielpowney Multi Rating security vulnerability


product: PB SEO Friendly Images

vendor: PB SEO Friendly Images

vendor: bajorat-media

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <= 4.0.5 versions.

title: Bajorat-Media Pb Seo Friendly Images security vulnerability


product: WP-OliveCart

vendor: Olive Design

product: wp-olivecart

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions.

title: Wp-Olivecart Project Wp-Olivecart security vulnerability


product: Yatra

vendor: MantraBrain

product: yatra

vendor: mantrabrain

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.

title: Mantrabrain Yatra security vulnerability


product: WSB Brands

vendor: Branko Borilovic

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <= 1.1.8 versions.

title: Wsb Brands Project Wsb Brands security vulnerability


vendor: WpDevArt

summary: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.


product: Open Graphite

vendor: Rocket Apps

vendor: rocketapps

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rocket Apps Open Graphite plugin <= 1.6.0 versions.

title: Rocketapps Open Graphite security vulnerability


product: My Tickets

vendor: Joseph C Dolson

summary: Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.


product: Donation Forms by Charitable

vendor: Charitable Donations & Fundraising Team

product: charitable

vendor: wpcharitable

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.10 versions.

title: Wpcharitable Charitable security vulnerability


product: UsersWP

vendor: AyeCode Ltd

product: userswp

vendor: ayecode

summary: Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

title: Ayecode Userswp security vulnerability


summary: Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.


vendor: ProfilePress Membership Team

product: profilepress

vendor: properfraction

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.

title: Properfraction Profilepress security vulnerability


product: Be POPIA Compliant

vendor: Web-X

product: be-popia-compliant

vendor: web-x

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection.This issue affects Be POPIA Compliant: from n/a through 1.2.0.

title: Web-X Be-Popia-Compliant security vulnerability


vendor: Viadat Creations

vendor: viadat

summary: Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.

title: Viadat Store Locator For Wordpress With Google Maps security vulnerability


product: WordPress WP-Advanced-Search

vendor: Mathieu Chartier

product: wp-advanced-search

vendor: internet-formation

summary: Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.


product: xili-tidy-tags

vendor: dev.xiligroup.com - MS

vendor: xiligroup

summary: Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <= 1.12.03 versions.


vendor: RexTheme

vendor: rextheme

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin <= 3.1.5 versions.

title: Rextheme Cart Lift - Abandoned Cart Recovery For Woocommerce And Edd security vulnerability


vendor: Unisoc (Shanghai) Technologies Co., Ltd.

product: android

vendor: google

summary: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.


summary: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.


summary: In gnss driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.


summary: In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service.


title: In wlan driver, there is a possible missing params check


summary: In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.


summary: In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.


title: In telephone service, there is a missing permission check


summary: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.


title: In telecom service, there is a missing permission check


summary: In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.


summary: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.


title: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check


summary: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.


title: In telephony service, there is a missing permission check


summary: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.


summary: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.


summary: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.


summary: In thermal service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service local denial of service with no additional execution privileges.


summary: In spipe drive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.


summary: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.


summary: In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.


title: In soter service, there is a possible out of bounds write due to a missing bounds check


title: In soter service, there is a possible missing permission check


product: Apache Helix

vendor: Apache Software Foundation

product: helix

vendor: apache

summary: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.

title: Apache Helix security vulnerability


product: Apache OFBiz

product: ofbiz

summary: Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.


product: Apache OpenOffice

product: openoffice

summary: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.


product: SolarWinds Platform

vendor: SolarWinds

version: 2022.4.1 and prior versions 2022.4.1

vendor: solarwinds

summary: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


version: 2022.4.1 and prior versions

title: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data


version: 2023.1 and prior versions

summary: The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.


summary: SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.


product: Server & Application Monitor (SAM)

summary: Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.

title: Solarwinds Server And Application Monitor security vulnerability


summary: The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.


version: SolarWinds 2022.4

summary: Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected

title: Solarwinds Solarwinds Platform security vulnerability


archetype: xxe

summary: An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

title: Xml-Rpc.Net Project Xml-Rpc.Net security vulnerability


product: drachtio-server

vendor: drachtio

summary: An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.


summary: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.


summary: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.


ecosystem: linux/kernel

vendor: linux

vendor: debian

vendor: netapp

summary: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.


summary: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.


summary: An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.


summary: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.


vendor: ieee

vendor: sonicwall

summary: The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.

title: Ieee Ieee 802.11 security vulnerability


vendor: zohocorp

summary: Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.

title: Zohocorp Manageengine Password Manager Pro security vulnerability


product: safe

vendor: f-secure

summary: F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.


vendor: fox-it

summary: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.


summary: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.


product: netwitness

vendor: rsa

summary: Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

title: Rsa Netwitness security vulnerability


vendor: ericsson

summary: An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell.

title: Ericsson Evolved Packet Gateway security vulnerability


product: filerun

vendor: filerun

summary: FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users§ion=cpanel&page=list request.


vendor: red-gate

summary: Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.


product: investigate

vendor: siren

summary: An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.


summary: An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.


product: gossipsub

vendor: protocol

summary: GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.

title: Protocol Gossipsub security vulnerability


product: op-tee

vendor: trustedfirmware

summary: An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.

title: Trustedfirmware Op-Tee security vulnerability


product: apiman

vendor: apiman

summary: Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.


product: ekorCCP

vendor: Ormazabal

product: ekorRCI

vendor: ormazabal

summary: Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server.

title: Ormazabal Ekorrci Firmware security vulnerability


summary: Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.


summary: Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.


summary: Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.


summary: Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.


summary: Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.


summary: Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.


summary: The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.


summary: The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.

title: Ormazabal Ekorccp Firmware security vulnerability


summary: Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.


summary: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."


summary: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."


product: m-vault

vendor: isode

summary: Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.


product: mintty

summary: Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.


product: Ultimate Addons for Contact Form 7

vendor: Themefic

vendor: themefic

summary: Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.

title: Themefic Ultimate Addons For Contact Form 7 security vulnerability


product: WP Search Analytics

vendor: Cornel Raiu

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.5 versions.

title: Wp Search Analytics Project Wp Search Analytics security vulnerability


product: Simple Photo Gallery

vendor: Tips and Tricks HQ, Peter Petreski

vendor: tipsandtricks-hq

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.

title: Tipsandtricks-Hq Simple Photo Gallery security vulnerability


product: CTT Expresso para WooCommerce

vendor: thisfunctional

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.

title: Thisfunctional Ctt Expresso Para Woocommerce security vulnerability


product: Maintenance Switch

vendor: Fugu

vendor: fugu

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.

title: Fugu Maintenance Switch security vulnerability


product: Map Multi Marker

vendor: Mickael Austoni

summary: Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.


product: MagicForm

product: magicform

summary: Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.


product: RapidLoad Power-Up for Autoptimize

vendor: RapidLoad

vendor: rapidload

summary: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.

title: Rapidload Rapidload Power-Up For Autoptimize security vulnerability


product: Essential Blocks for Gutenberg

vendor: WPDeveloper

vendor: wpdeveloper

summary: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5.

title: Wpdeveloper Essential Blocks security vulnerability


product: WP Go Maps (formerly WP Google Maps)

vendor: WP Go Maps

vendor: codecabin

summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions.

title: Codecabin Wp Go Maps security vulnerability


product: Media Library Categories

vendor: Jeffrey-WP

vendor: jeffrey-wp

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.

title: Jeffrey-Wp Media Library Categories security vulnerability


vendor: Popup Maker

vendor: code-atlantic

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.

title: Code-Atlantic Popup Maker security vulnerability


product: WP Super Popup

vendor: WP Plugins Pro

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions.

title: Wp Super Popup Project Wp Super Popup security vulnerability


vendor: File Manager by Bit Form Team

vendor: bitapps

summary: Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.

title: Bitapps File Manager security vulnerability


product: Mass Email To users

vendor: I Thirteen Web Solution

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Mass Email To users plugin <= 1.1.4 versions.

title: I13Websolution Mass Email To Users security vulnerability


product: WP Table Manager

vendor: JoomUnited

summary: Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.

title: Joomunited Wp Table Manager security vulnerability


vendor: joomunited

summary: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions.


vendor: wpdevart

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.

title: Wpdevart Image And Video Gallery With Thumbnails security vulnerability


product: AJAX Thumbnail Rebuild

vendor: junkcoder, ristoniinemets

summary: Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13.

title: Junkcoder, Ristoniinemets Ajax Thumbnail Rebuild security vulnerability


product: Custom 404 Pro

vendor: Kunal Nagar

vendor: kunalnagar

summary: Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.

title: Kunalnagar Custom 404 Pro security vulnerability


product: WP-CORS

vendor: Tim Stephenson

product: wp-cors

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Stephenson WP-CORS plugin <= 0.2.1 versions.

title: Wp-Cors Project Wp-Cors security vulnerability


product: Usersnap

vendor: Usersnap

product: usersnap

vendor: usersnap

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.

title: Usersnap security vulnerability


product: Quick Contact Form

vendor: Fullworks

vendor: fullworksplugins

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

title: Fullworksplugins Quick Contact Form security vulnerability


product: DNUI

vendor: Nicearma

product: dnui-delete-not-used-image

vendor: nicearma

summary: Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions.


product: Simple Image Popup

vendor: Mr Digital

vendor: mrdigital

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.

title: Mrdigital Simple Image Popup security vulnerability


product: Hover Image

vendor: Julian Weinert // cs&m

summary: Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m Hover Image plugin <= 1.4.1 versions.


product: Participants Database

vendor: Roland Barker, xnau webdesign

vendor: xnau

summary: Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.

title: Xnau Participants Database security vulnerability


product: AI ChatBot

vendor: QuantumCloud

product: wpbot

vendor: quantumcloud

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.

title: Quantumcloud Wpbot security vulnerability


product: MStore API

vendor: InspireUI

vendor: inspireui

summary: Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.

title: Inspireui Mstore Api security vulnerability


product: LearnPress – WordPress LMS Plugin

vendor: ThimPress

product: learnpress

vendor: thimpress

summary: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.


product: Hitron CODA-5310

vendor: Hitron Technologies Inc.

version: all version

vendor: hitrontech

summary: Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.


summary: Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption.


product: AH55B04 DVR firmware

vendor: Merit Lilin Ent. Co., Ltd.

version: unspecified

product: AH55B08 DVR firmware

vendor: meritlilin

summary: Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.


product: libksba

vendor: gnupg

vendor: debian

summary: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.


vendor: trustedfirmware

summary: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.


product: synapse

vendor: razer

summary: Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.


summary: Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.

title: Razer Synapse security vulnerability


product: kyverno

vendor: kyverno

summary: An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.

title: Kyverno security vulnerability


product: m-link

vendor: isode

summary: M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain HTTP endpoints, aka LINK-2867.

title: Isode M-Link security vulnerability


archetype: ssrf

product: wms

vendor: wildix

summary: Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.

title: Wildix Wms security vulnerability


vendor: outsystems

summary: A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.


vendor: xampp

product: xampp

vendor: apachefriends

summary: The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory. Common use cases execute files under C:\xampp with administrative privileges.


vendor: Bosch

version: All Versions

vendor: bosch

summary: An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).

title: Bosch B420 Firmware security vulnerability


product: gpac

vendor: gpac

summary: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3_update_channels function of media_tools/av_parsers.c:9113


summary: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261

title: Gpac security vulnerability


vendor: struktur

summary: Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>


summary: GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8273

title: Gpac security vulnerability


summary: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc_parse_vps_extension of media_tools/av_parsers.c:7662


summary: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf_hevc_read_vps_bs_internal of media_tools/av_parsers.c:8039

title: Gpac security vulnerability


summary: GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf_bs_read_data


summary: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom_write.c


summary: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via media_tools/av_parsers.c:4988 in gf_media_nalu_add_emulation_bytes

title: Gpac security vulnerability


summary: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662

title: Gpac security vulnerability


summary: GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer overflow in h263dmx_process filters/reframe_h263.c:609


summary: Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse


summary: Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)


product: binutils

vendor: gnu

summary: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.

title: Gnu Binutils security vulnerability


summary: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.

title: Gnu Binutils security vulnerability


summary: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

title: Gnu Binutils security vulnerability


summary: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can reset the password of the admin accounts.

title: Comfast Project Cf-Wr623N Firmware security vulnerability


summary: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filtering feature in the router.


summary: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control.


summary: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentication.


summary: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS).


vendor: tianjie

summary: TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version CPF906-V5.0_LCD_20200513.


vendor: lastyard

summary: Last Yard 22.09.8-1 does not enforce HSTS headers


summary: In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.


summary: Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).


vendor: yeastar

summary: In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.

title: Yeastar N824 Firmware security vulnerability


vendor: seltmann-webdesign

summary: Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.


product: zentao

vendor: easycorp

summary: ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.


product: kraken

vendor: uber

summary: kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.


product: imo

vendor: imo

summary: In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.

title: Imo security vulnerability


vendor: nanoleaf

summary: Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.


product: gin-vue-admin

summary: In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.


product: popojicms

vendor: popojicms

summary: PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.


vendor: solar-log

summary: A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included). This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base.


vendor: serinf

summary: Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.


summary: An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell.

title: Serinf Fast Checkin security vulnerability


summary: Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.


product: bangresto

summary: SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.


summary: Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.


vendor: bezeq

summary: An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07.09.09T, allows remote attackers to gain sensitive information via rootDesc.xml page of the UPnP service.

title: Bezeq Vtech Nb403-Il Firmware security vulnerability


vendor: totolink

summary: TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.


product: i-librarian

vendor: i-librarian

summary: i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php.


summary: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.


summary: Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.


vendor: red-gate

summary: A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web Script or HTML via the returnUrl parameter.

title: Red-Gate Sql Monitor security vulnerability


product: maccms

vendor: maccms

summary: A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.

title: Maccms security vulnerability


product: keos

vendor: netcad

summary: Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).


product: cloud

vendor: jedox

product: jedox

summary: Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox.etl.mngr.Connections' and method 'getGlobalConnection'.

title: Jedox Cloud security vulnerability


summary: A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code.

title: Jedox Cloud security vulnerability


summary: The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.


summary: A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in the Logs page via the log module 'log'.

title: Jedox security vulnerability


summary: Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. Consecutive file uploads can lead to the execution of arbitrary code. NOTE: The vendor states that the vulnerability affects installations running version 22.2 or earlier. The issue was resolved with the version 22.3 and later versions are not affected. Additionally, the vendor states that this vulnerability affects on-premises deployments only and that it does not impact cloud-hosted or SaaS environments.

title: Jedox security vulnerability


summary: A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.

title: Jedox security vulnerability


summary: An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.

title: Jedox security vulnerability


vendor: foxit

summary: Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.


vendor: Riello UPS

less_than_or_equal: all versions

vendor: riello-ups

summary: All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.

title: Riello-Ups Netman 204 Firmware security vulnerability


summary: All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.


summary: There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.


product: Apache Zeppelin SAP

vendor: Apache Software Foundation

product: zeppelin

vendor: apache

summary: Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. For more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


product: IntelliJ IDEA

vendor: JetBrains

vendor: jetbrains

summary: In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.


summary: In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.