4705 matches found
GSD-2022-1003195 s390/gmap: voluntarily schedule during key setting
s390/gmap: voluntarily schedule during key setting This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...
GSD-2022-1002886 s390/gmap: voluntarily schedule during key setting
s390/gmap: voluntarily schedule during key setting This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.15 by commit...
CVE-2022-30337
Cross-Site Request Forgery CSRF vulnerability in JoomUnited WP Meta SEO plugin = 4.4.8 at WordPress allows an attacker to update the social settings...
PT-2022-31727
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue is related to the s390/gmap voluntarily scheduling during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the "Toggle thecontent filter" setting PoC POST /wp-json/yikes/cpt/v1/settings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the "Toggle thecontent filter" setting POST /wp-json/yikes/cpt/v1/settings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...
PT-2022-31927
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to the s390/gmap, which voluntarily schedules during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
PT-2022-31149
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.17.15 Description The issue is related to the s390/gmap voluntarily scheduling during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...
PT-2022-31458
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue is related to the s390/gmap voluntarily scheduling during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...
PT-2022-30791
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.18.4 Description The issue is related to the s390/gmap, which voluntarily schedules during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
CVE-2022-1845
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...
WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting
The plugin doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks. PoC https://example.com/wp-admin/admin.php?page=wpowcpdfoptionspage=xxxxx%22+accesskey%3DX+onclick%3Dalert%281%29+test%3D%22...
PT-2022-14177
Name of the Vulnerable Software and Affected Versions underConstruction WordPress plugin versions prior to 1.21 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization or escaping of the Display a custom page using your own HTML...
PT-2022-14149
Name of the Vulnerable Software and Affected Versions Amazon Einzeltitellinks WordPress plugin versions 1.3.3 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This...
PT-2022-14146
Name of the Vulnerable Software and Affected Versions PDF24 Article To PDF WordPress plugin versions 4.2.2 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This cou...
Ghost vulnerable to remote code execution in locale setting change
Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...
GHSA-7V28-G2PQ-GGG8 Ghost vulnerable to remote code execution in locale setting change
Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...
CVE-2022-33175
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...