Atlassian Bitbucket 8.1.x < 8.1.5 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

CVE-2022-41135

Unauth. Plugin Settings Change vulnerability in Modula plugin = 2.6.9 on WordPress...

Arbitrary file deletion

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin = 3.6.15 on WordPress...

CVE-2022-43781

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...

CVE-2022-40290

CVE-2022-40290 affects PHP Point of Sale (POS) version 19.0, with an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation feature. The underlying issue allows an attacker to craft an unsafe link that could compromise users. Public details consistently descr...

Vulnerability fixed in FortiGate and FortiProxy

Fortinet has fixed a vulnerability in FortiGate and FortiProxy. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to bypass authentication on the management interface and thus perform actions perform actions normally reserved for authenticated...

Buffer overflow

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS...

PT-2022-24129 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS versions 6.4.4.8 through 4.2.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS...

CVE-2022-41522

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function...

Information disclosure

Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin = 5.3.5 at WordPress...

CVE-2022-40193 WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability in Awesome Filterable Portfolio plugin = 1.9.7 at WordPress...

PT-2022-23317 · WordPress · Mailoptin

Name of the Vulnerable Software and Affected Versions: MailOptin plugin versions 1.2.49.0 and earlier Description: The issue concerns an Unauthenticated Optin Campaign Cache Deletion vulnerability. This vulnerability affects the MailOptin plugin at WordPress, allowing for unauthenticated cache...

Path traversal

The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25...

CVE-2022-2265 Path traversal in Identity and Directory Management System

The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25...

CVE-2022-2315 SQL Injection in Database Accreditation System

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

Directory Management System 路径遍历漏洞

Directory Management System is a directory management system by the individual developer Anuj Kumar. A path traversal vulnerability exists in Directory Management System versions prior to 2.1.25, which stems from an unauthenticated path traversal vulnerability...

CVE-2022-36793 WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities

Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin = 3.9.6 at WordPress...

PT-2022-24182 · Totalsoft · Totalsoft Event Calendar

Name of the Vulnerable Software and Affected Versions: Totalsoft Event Calendar – Calendar plugin versions 1.4.6 and earlier Description: The issue concerns an Unauthenticated Event Deletion vulnerability. Recommendations: For versions 1.4.6 and earlier, update to a version later than 1.4.6 to...

CVE-2022-35242

Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin = 3.4.1 at WordPress...

PT-2022-19641 · 8 Degree Themes · 8 Degree Themes Notification Bar

Name of the Vulnerable Software and Affected Versions: 8 Degree Themes Notification Bar for WordPress plugin version 1.1.8 and earlier Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...