WordPress Quick Restaurant Menu Plugin <= 2.0.2 is vulnerable to Broken Access Control

Software Quick Restaurant Menu Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0555 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 7bcc03da4182 Credits Marco Wotschka Ivan...

WordPress Quick Restaurant Menu Plugin <= 2.0.2 is vulnerable to Insecure Direct Object References (IDOR)

Software Quick Restaurant Menu Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-0550 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID 53344b864cc7 Credits Marco...

PT-2023-8901

Name of the Vulnerable Software and Affected Versions Rack versions 1.5.0 through 2.0.9.1 Rack versions 2.1.0 through 2.1.4.1 Rack versions 2.2.0 through 2.2.6.1 Rack versions 3.0.0 through 3.0.0.0 Description A denial of service vulnerability in the Range header parsing component of Rack can cau...

WordPress Universal Star Rating Plugin <= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Universal Star Rating Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46867 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1a388ca6e1a9 Credits Mika Required...

DEBIAN-CVE-2022-23515

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.1.0, 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1...

ZTE ZXA10 C3XX 安全漏洞

ZTE ZXA10 C3XX is a series of optical access aggregation equipment with EPON/GPON function from China ZTE Corporation ZTE. An access control error vulnerability exists in the ZTE ZXA10 C3XX version 2.1.0 and later, before 2.1.0xgp002.4. The vulnerability stems from improper access control setting...

Unsafe deserialization in Apache MINA SSHD

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...

PT-2022-26760 · Unknown · Flatcore-Cms

Name of the Vulnerable Software and Affected Versions: flatCore-CMS version 2.1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field. Recommendations: For flatCore-CMS version 2.1.0, a...

Authentication flaw

Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit...

Dell EMC PowerStore 授权问题漏洞

Dell EMC PowerStore is a storage device from Dell USA. A security vulnerability exists in Dell EMC PowerStore version 2.1.0.x, which stems from contains an authentication bypass vulnerability. An attacker could exploit the vulnerability to gain unauthorized access...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from containerd, gnupg2, runc and IBM WebSphere Application Server Liberty

Summary Multiple issues were identified in Red Hat UBIubi8/ubi-minimal v8.6-x packages containerd, gnupg2, runc and IBM WebSphere Application Server Liberty that were shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. Vulnerability Details CVEID:CVE-2022-23648 DESCRIPTION...

Discourse DiscoTOC Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A cross-site scripting vulnerability exists in versions prior to Discourse DiscoTOC 2.1.0, which stems from the lack of escaping and filtering of input data on pages that can...

CVE-2022-3222

Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV...

GPAC 安全漏洞

GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC 2.1.0-DEV that stems from a segmentation error in SFSExpression...

CVE-2022-3178

Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV...

CVE-2022-3178

Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV...

GPAC 缓冲区错误漏洞

GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC 2.1.0-DEV, which can be exploited by an attacker to cause a buffer over-read...

HCL Technologies VersionVault Express Information Disclosure Vulnerability

HCL Technologies VersionVault Express is an intuitive side-by-side comparison viewer from HCL Technologies, India. to easily compare files and directories in it. An information disclosure vulnerability exists in HCL Technologies VersionVault Express version 2.0.1, version 2.1.0, which stems from...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0 (Firmware A2.1.0–B2.1.0; Software v16 13020200; App 2.15.4A) is affected by an unauthenticated arbitrary file disclosure due to improper verification of the 'file' GET parameter in logdownload.cgi. The vulnerability allows directory traversal to disclose arb...

HCL Technologies VersionVault Express 代码问题漏洞

HCL Technologies VersionVault Express is an intuitive side-by-side comparison viewer from HCL Technologies, India. to easily compare files and directories in it. A security vulnerability exists in HCL Technologies VersionVault Express versions 2.0.1 and 2.1.0, which originates from the possibilit...