6722 matches found
CVE-2022-48348
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity...
CVE-2023-1635 OTCMS apiRun.php AutoRun cross site scripting
A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...
aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +382 more potentially affected by unknown CVE via openssl (>=0.9.24, <=0.10.40)
openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.0.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3GXF-9R58-2GHG...
CVE-2023-26008 WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin = 3.2.4 versions...
CVE-2022-48423
In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur...
CVE-2023-28112 Discourse's SSRF protection missing for some FastImage requests
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the...
CVE-2022-38456 WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin = 4.10.3 versions...
CVE-2023-24867 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
...
CVE-2023-23395 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2022-47163 WordPress WP CSV to Database Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin = 2.6 versions...
CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...
CVE-2023-26110
All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation...
CVE-2023-24123
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet...
CVE-2022-23240
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorized users to update EMS Subscriptions via unspecified vectors...
CVE-2023-26303 markdown-it-py crash on null assertions
Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input...
CVE-2023-22935 SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects...
CVE-2022-3089 EnOcean SmartServer Hard-coded credentials
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file...
CVE-2023-21445
Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R11, 13.1.03.501 in Android S12 and 14.1.00.422 in Android T13 allows local attacker to write file with MyFiles privilege via implicit intent...
CVE-2022-42909
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to...