CVE-2022-0674

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-39353

The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajaxaddform function found in the /includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including...

CVE-2021-43331

In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS...

PT-2021-10924 · Unknown · 188Jianzhan

Name of the Vulnerable Software and Affected Versions: 188Jianzhan version 2.1.0 Description: The issue allows attackers to execute arbitrary code and gain escalated privileges. This is achieved via the username parameter to the "login.php" endpoint. Recommendations: For 188Jianzhan version 2.1.0...

CVE-2021-20834

Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

@enonic/semantic-ui-react-form (>=2.1.0 <=2.3.0) potentially affected by CVE-2021-23440 via set-value (=4.0.0)

set-value NPM version =4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on set-value and may be impacted: - @enonic/semantic-ui-react-form =2.1.0, =2.3.0 Source cves: CVE-2021-23440 Source advisory: OSV:GHSA-4JQC-8M5R-9RPR...

CVE-2021-38349

The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the errordescription parameter found in the /templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Steam Group Viewer plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPre...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32532

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32533

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

AMP 输入验证错误漏洞

AMP is a software application. Used to track all issues and bugs within the CubeCoders AMP platform. A security vulnerability exists in CubeCoders AMP versions prior to 2.1.1.8, which can be exploited by attackers to cause code execution to be triggered by highly privileged users...

PYSEC-2021-171

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.SparseConcat. This is because the...

PYSEC-2021-663

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedResizeBilinear by passing in invalid thresholds for the quantization. This is because the...

CVE-2021-23910

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds array access in RemoteDiagnosisApp...

Mercedes Benz HERMES 缓冲区错误漏洞

Mercedes Benz HERMES E Series is a series of Hermes Edition E Series cars by Mercedes Benz of Germany. A security vulnerability exists in HERMES version 2.1. The vulnerability originates from an out-of-bounds array access in the RemoteDiagnosisApp of the program...

Sourceforge组织 Course Registration Management System 跨站脚本漏洞

Sourceforge Organization Course Registration Management System is an open source application from the Sourceforge Organization. A course management system for anyone who is running a course. A cross-site scripting vulnerability exists in CourseMS aka Course Registration Management System 2.1, whi...

Microsoft .NET Core Security Vulnerability

Microsoft .NET Core is a free open source development platform from Microsoft USA. The platform features multi-language support and cross-platform capabilities. A security vulnerability exists in Microsoft .NET Core. The following products and versions are affected: .NET Core 2.1, .NET Core 3.1,...

CVE-2020-36170

The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms...

ABB Symphony Plus Operations Access Control Error Vulnerability

ABB Symphony Plus Operations is a management device from ABB Switzerland for improving operational efficiency in industrial environments. The appliance provides an easy-to-use human-machine interface that seamlessly integrates all plant equipment and subsystems using industry-standard protocols a...