17063 matches found
CVE-2023-33984
SAP NetWeaver (Design Time Repository) v7.50 is affected. The issue arises from returning an unfavorable content type for certain versioned files, enabling an authorized attacker to create a file containing malicious content and share a link resulting in cross-site scripting (XSS). Public referen...
PT-2023-20391 · Unknown · Design Extreme We’Re Open!
Name of the Vulnerable Software and Affected Versions: Design Extreme We’re Open! plugin versions 1.46 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Design Extreme We’re...
WordPress Plugin Noah Hearle,Design Extreme Were Open 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-3744 · Sap · Sap Netweaver
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Design Time Repository version 7.50 Description: The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to inject arbitrary HTML code. This could enable an authorized attacker to...
Design/Logic Flaw
An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it...
Design/Logic Flaw
AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure, or data tampering...
Design/Logic Flaw
The Danfoss AK-EM100 stores login credentials in cleartext...
Design/Logic Flaw
An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files...
Design/Logic Flaw
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files...
Design/Logic Flaw
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files...
Design/Logic Flaw
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files...
Design/Logic Flaw
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files...
Design/Logic Flaw
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files...
Design/Logic Flaw
A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak...
Design/Logic Flaw
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this...
Design/Logic Flaw
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin settings. While a nonce check is...
Design/Logic Flaw
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templatecount function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin template information. While ...
Design/Logic Flaw
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalinksetup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the...
Design/Logic Flaw
Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The...