6448 matches found
Path traversal
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to for example in multisite...
CVE-2022-4119 Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSS
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
CVE-2022-4370 Multimedial Images <= 1.0b - Admin+ SQLi
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin...
PT-2023-14292 · WordPress · Multimedial Images
Name of the Vulnerable Software and Affected Versions: multimedial images WordPress plugin versions 1.0b and earlier Description: The issue arises from the multimedial images WordPress plugin not properly sanitizing and escaping a parameter before using it in a SQL statement. This leads to a SQL...
PT-2023-14267 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-15445 · Isode · M-Link
Name of the Vulnerable Software and Affected Versions: Isode M-Link versions R16.2v1 through R17.0 before R17.0v24 Description: The issue allows non-administrative users to access and manipulate archive data via certain HTTP endpoints. Recommendations: For versions R16.2v1 through R17.0 before...
Hillstone Networks Firewall 安全漏洞
Hillstone Networks Firewall is a series of firewalls from China-based Hillstone Networks. A security vulnerability exists in Hillstone Networks Firewall SG-6000 5.0.4.0 and prior versions, which stems from a misconfiguration of report.m in its Web Application Firewall that results in an access...
CVE-2022-4197
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-3835
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-24407 · WordPress · Login For Google Apps
Name of the Vulnerable Software and Affected Versions: Login for Google Apps WordPress plugin versions prior to 3.4.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
CVE-2022-45893
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access...
CVE-2022-28173
The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices...
CVE-2022-4619
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2022-28173
The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices...
CVE-2022-4112
The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-7140 · Zoho · Zoho Manageengine Device Control Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Device Control Plus version 10.1.2228.15 Description: An issue in the endpoint protection agent of Zoho ManageEngine Device Control Plus allows bypassing USB restrictions by using a virtual machine VM, enabling file exchange...
PT-2022-27715 · Shoplazza · Shoplazza Lifestyle
Name of the Vulnerable Software and Affected Versions: Shoplazza LifeStyle version 1.1 Description: A vulnerability was found in the Product Carousel Handler component, affecting an unknown part of the file /admin/api/theme-edit/. The manipulation of the Heading/Description argument leads to...
MGASA-2022-0466 Updated couchdb packages fix security vulnerability
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...
