CVE-2023-49343

Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

Design/Logic Flaw

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdoptionvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-5713 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdoptionvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-5710

CVE-2023-5710 affects the WordPress System Dashboard plugin up to version 2.8.7, where a missing capability check in the sd_constants() function exposed data via an AJAX action. This allows authenticated users with subscriber-level access or higher to retrieve sensitive information, including dat...

CVE-2023-39326

CVE-2023-39326 describes a vulnerability in the Go net/http chunked encoding reader where a malicious HTTP sender can insert large chunk metadata, causing a receiver to read far more bytes than the body and potentially trigger a server to read up to about 1 GiB of data. The description explains c...

Site Reviews < 6.10.3 - Missing Authorization

Description The Site Reviews plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'assignPost' and 'unassignPost' functions in versions up to, and including, 6.10.2. This makes it possible for authenticated attackers to assign and unassi...

Carousel Slider < 2.2.3 - Missing Authorization

Description The Carousel Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoptinoptout function hooked via 'admininit' in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to opt i...

LuckyWP Scripts Control <= 1.2.1 - Missing Authorization

Description The LuckyWP Scripts Control plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform...

WP GPX Map < 1.7.06 - Missing Authorization

Description The WP GPX Map plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpgpxmapsdismissnotice function in versions up to, and including, 1.7.05. This makes it possible for authenticated attackers, with subscriber-level access an...

Design/Logic Flaw

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaddcategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5385 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfcopyposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

Deserialization of untrusted data

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction...

The vulnerability of the H5/speedlimit.data function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G, DI-7100GV2, DI-7200G, DI-7200GV2, DI-7300G, and DI-7400G allows a violator to execute arbitrary code.

The vulnerability of the H5/speedlimit.data function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G, DI-7100GV2, DI-7200G, DI-7200GV2, DI-7300G, and DI-7400G lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote...

CVE-2023-47104

tinyfiledialogs aka tiny file dialogs before 3.15.0 allows shell metacharacters such as a backquote or a dollar sign in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters...

Input validation

tinyfiledialogs aka tiny file dialogs before 3.8.0 allows shell metacharacters in titles, messages, and other input data...

Apache InLong 代码问题漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong has a deserialization vulnerability that originates from unsafe deserialization processing of serialized data receive...

The vulnerability of the gwcfg_cgi_set_manage_post_data() function in the microprogramming-based industrial Wi-Fi routers developed by Yifan YF325 allows a hacker to influence the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the gwcfgcgisetmanagepostdata function in the microprogrammed industrial Wi-Fi routers from Yifan YF325 relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to influence the integrity, availability, and...

CVE-2023-5450 BIG-IP Edge Client for macOS vulnerability

An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-5450

The CVE-2023-5450 issue affects F5 BIG-IP Edge Client for macOS. Affected: BIG-IP Edge Client Installer on macOS (APM) with insufficient data verification during installation, enabling local privilege escalation. Affected branches and fixes: BIG-IP APM macOS clients on 17.x (vulnerable 17.1.03; f...

Cross Site Scripting

thorsten/phpmyfaq is vulnerable to Cross Site Scripting. The vulnerability is due to improper sanitization of data. This can be exploited by an attacker to inject malicious JavaScript into the web application...