6540 matches found
CVE-2022-4662 affecting package kernel for versions less than 5.15.92.1-1
CVE-2022-4662 affecting package kernel for versions less than 5.15.92.1-1. A patched version of the package is available...
CVE-2022-27666 affecting package hyperv-daemons for versions less than 5.15.92.1-1
CVE-2022-27666 affecting package hyperv-daemons for versions less than 5.15.92.1-1. A patched version of the package is available...
GO-2023-1519 Command injection in github.com/rancher/wrangler
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed...
CVE-2023-22895 affecting package mozjs60 60.9.0-10
CVE-2023-22895 affecting package mozjs60 60.9.0-10. A patched version of the package is available...
CVE-2023-23454 affecting package kernel 5.10.164.1-1
CVE-2023-23454 affecting package kernel 5.10.164.1-1. A patched version of the package is available...
CVE-2022-47929 affecting package kernel 5.10.164.1-1
CVE-2022-47929 affecting package kernel 5.10.164.1-1. A patched version of the package is available...
CVE-2023-0286 affecting package openssl 1.1.1k-16
CVE-2023-0286 affecting package openssl 1.1.1k-16. A patched version of the package is available...
CVE-2022-42012 affecting package dbus 1.13.6-5
CVE-2022-42012 affecting package dbus 1.13.6-5. A patched version of the package is available...
CVE-2022-48281 affecting package libtiff 4.4.0-6
CVE-2022-48281 affecting package libtiff 4.4.0-6. A patched version of the package is available...
CVE-2022-42010 affecting package dbus 1.13.6-5
CVE-2022-42010 affecting package dbus 1.13.6-5. A patched version of the package is available...
WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)
Software Fancy Comments WordPress Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23670 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d8c2e0ffbd22 Credits István Márto...
Formwork Cross-site Scripting (XSS) from Page title field
Description A stored cross-site scripting XSS vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in th...
WordPress Metform Elementor Contact Form Builder 3.1.2 Cross Site Scripting Vulnerability
WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from a persistent cross site scripting vulnerability. Affected Plugin: Metform Elementor Contact Form Builder Plugin Slug: metform Affected Versions: = 3.1.2 CVE ID: CVE-2023-0084 CVSS Score: 7.2 High CVSS...
CVE-2023-0669 Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...
CVE-2023-23940 OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature. As a result, any contract using isvalidethsignature from the...
CVE-2023-23937 Missing file upload type validation in pimcore/pimcore
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid...
CVE-2023-23925 Switcher Client contains Regular Expression Denial of Service (ReDoS)
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...
WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization Vulnerabilities
On January 16, 2023, the Wordfence Threat Intelligence team responsibly disclosed several vulnerabilities in Quick Restaurant Menu, a WordPress plugin that allows users to set up restaurant menus on their sites. This plugin is vulnerable to missing authorization, insecure direct object reference,...