6842 matches found
PT-2022-24292 · WordPress · Donations Via Paypal
Name of the Vulnerable Software and Affected Versions: Donations via PayPal WordPress plugin versions prior to 1.9.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
CVE-2022-2513
A vulnerability exists in the Intelligent Electronic Device IED Connectivity Package ConnPack credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An...
CVE-2022-45082
Multiple Auth. admin+ Stored Cross-Site Scripting XSS vulnerabilities in Accordions plugin = 2.0.3 on WordPress via &addons-style-name and &accordionsorfaqslicensekey...
CVE-2022-44634
Auth. admin+ Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin = 1.1.12 on WordPress...
CVE-2022-44736
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Chameleon plugin = 1.4.3 on WordPress...
CVE-2022-44591
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anthologize plugin = 0.8.0 on WordPress...
PT-2022-27290 · Unknown · Chameleon Plugin
Name of the Vulnerable Software and Affected Versions: Chameleon plugin versions 1.4.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin or higher privileges. The estimated number of potentially...
UBUNTU-CVE-2022-30768
A Stored Cross Site Scripting XSS issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin or non-Admin users that can see other users logged into the platform clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 an...
CVE-2022-3539
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
PT-2022-22298 · WordPress · Wp Attachments
Name of the Vulnerable Software and Affected Versions: WP Attachments versions prior to 5.0.5 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitized and escaped. The atta...
Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the Youtube API K...
PT-2022-24213 · Unknown · Upsmon Pro
Name of the Vulnerable Software and Affected Versions: UPSMON Pro affected versions not specified Description: The UPSMON Pro login function has insufficient authentication, allowing an unauthenticated remote attacker to bypass authentication and gain administrator privileges to access, control t...
CVE-2022-31685
VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...
CVE-2022-31687
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...
CVE-2022-31686
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...
PT-2022-25660 · WordPress · Wholesale Market For Woocommerce
Name of the Vulnerable Software and Affected Versions: The Wholesale Market for WooCommerce WordPress plugin versions prior to 2.0.0 Description: The issue allows high privilege users, such as admins, to download arbitrary logs from the server due to a lack of validation against path traversal...
VMware Workspace ONE Assist 安全漏洞
VMware Workspace ONE Assist is a real-time remote support solution from VMware, Inc. It allows VMware Workspace ONE UEM administrators to remotely access and troubleshoot devices in real-time while respecting end-user privacy. A security vulnerability exists in VMware Workspace ONE Assist prior t...
Acronis Cyber Protect/Backup remote code execution
Acronis Cyber Protect or Backup is an enterprise backup/recovery solution for all, compute, storage and application resources. Businesses and Service Providers are using it to protect and backup all IT assets in their IT environment. The Acronis Cyber Protect appliance, in its default...
CVE-2022-2711
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vect...