23602 matches found
CVE-2023-25795
Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API...
CVE-2023-25447
Cross-Site Request Forgery CSRF vulnerability in Inkthemescom ColorWay theme = 4.2.3 versions...
CVE-2023-25038
Cross-Site Request Forgery CSRF vulnerability in 984.Ru For the visually impaired plugin = 0.58 versions...
CVE-2023-25022
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kiboko Labs Watu Quiz plugin = 3.3.8 versions...
CVE-2023-25965
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0...
CVE-2023-43528
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size...
CVE-2023-43521
Memory corruption when multiple listeners are being registered with the same file descriptor...
CVE-2023-29047
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible...
CVE-2023-29056
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined...
CVE-2023-29164
Improper access control in BMC Firmware for the IntelR Server Board S2600WF, IntelR Server Board S2600ST, IntelR Server Board S2600BP, before version 02.01.0017 and IntelR Server Board M50CYP and IntelR Server Board D50TNP before version R01.01.0009 may allow an authenticated user to enable...
CVE-2023-29004
hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI 6.3.9.0 at the moment of writing this report. The vulnerability can be exploited via an HTTP request to /app/options.py and the...
CVE-2023-49135
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer...
CVE-2023-49802
The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin an...
CVE-2023-45072
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kardi Order auto complete for WooCommerce plugin = 1.2.0 versions...
CVE-2023-45656
Cross-Site Request Forgery CSRF vulnerability in Kevin Weber Lazy Load for Videos plugin = 2.18.2 versions...
CVE-2023-45613
In JetBrains Ktor before 2.3.5 server certificates were not verified...
CVE-2023-45846
Incomplete cleanup in IntelR Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local access...