CVE-2021-43417

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2022-23724

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...

CVE-2019-16158

Fortinet FortiManager GUI contains an improper neutralization of input in the buffer parameter, enabling an authenticated attacker to perform an XSS attack. This vulnerability is documented in FG-IR-19-271 and is referenced in CNVD-2020-19918. No specific patch/version details are provided in the...

travismanion.org Cross Site Scripting vulnerability OBB-2562833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-27925

Zimbra Collaboration aka ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. Recent assessments: rbowes-r7 a...

CVE-2014-9511

Summary: CVE-2014-9511 maps to a WordPress vulnerability in the Sell Downloads plugin (versions ≤ 1.0.1). The issue arises from a lack of input sanitization, allowing an attacker to disclose arbitrary files on the server by accessing them through the web context. This can lead to exposure of serv...

CVE-2014-8814

The connected sources confirm a reflected XSS affecting the WordPress WP Photo Album Plus plugin up to version 5.4.17. The vulnerability allows injection of arbitrary JavaScript/HTML; remediation is to update the plugin to a non-vulnerable version.

CVE-2014-9309

Formidable Forms (WordPress) plugin

CVE-2020-11510

Technical details for CVE-2020-11510 are not publicly available in the provided documents. Monitor for updates.

CVE-2021-31157

Summary (CVE-2021-31157): WordPress WPGraphQL plugin versions = 1.3.6. If upgrading is not possible, monitor for unusual query loads and consider disabling batching as a temporary workaround (note: explicit workaround details cited in sources).

CVE-2021-35470

The CVE placeholder CVE-2021-35470 is superseded by concrete details from connected sources: WordPress Inline Related Posts plugin (

catalog.carnegiestout.org Cross Site Scripting vulnerability OBB-2536409

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2018-7168

OpenAFS has a vulnerability tracked as CVE-2018-7168. Mageia/MGASA-2021-0509 notes that in-the-wild AFS3 clients could improperly construct ACLs and store them via RXAFS_StoreACL (opcode 134), with a defensive measure implemented by introducing a new RXAFS_StoreACL opcode (164) to identify proper...

CVE-2021-25632

CVE-2021-25632 is a LibreOffice vulnerability with code execution impact. Affected products are LibreOffice 7.0.x before 7.0.6 and 7.1.x before 7.1.3. The issue arises from an insecure handling path leading to arbitrary code execution. Some connected sources also reference an update to LibreOffic...

CVE-2021-29270

CVE-2021-29270 is referenced in the Mageia/MGASA-2021-0365 advisory as a vulnerability in systemd. The issue affects systemd versions 220–248, where a memory allocation with an excessive size value (involving strdupa and alloca for a pathname controlled by a local attacker) can crash the operatin...

CVE-2019-19233

The connected OpenVAS/Mageia OSV/OSVDB entries document CVEs related to sudo in CVE-2019-19232 and CVE-2019-19234. The advisory MGASA-2020-0246 explains that sudo could run commands with unknown user/group ids when configured with aliases like ALL, potentially letting sudo impersonate non-existen...

CVE-2017-10516

CVE-2017-10516 is linked to a cross-site scripting (XSS) vulnerability in Pallets Werkzeug prior to 0.11.11. The issue resides in the render_full function within the debug/tbtools.py debugger, allowing remote attackers to inject arbitrary script/HTML via an exception message. Affected product/ver...

CVE-2013-2320

CVE-2013-2320 is referenced in Mageia/MGASA-2015-0156 as SSLv2 support still being available within Mono’s TLS stack. The connected OpenVAS entry and OSV/Mageia advisory confirm the TLS-related issues are addressed in updated Mono packages (the advisory notes a TLS impersonation issue (CVE-2015-2...

unisar.reumatologia.org.ar Cross Site Scripting vulnerability OBB-2505943

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...