2473 matches found
CVE-2022-39113
In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges needed...
CVE-2022-39095
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39094
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39090
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39096
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39102
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39101
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...
CVE-2022-39109
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed...
CVE-2022-37044
In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...
CVE-2022-3374
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import intentionally or not a malicious Customizer Styling file and a suitable gadget chain is present on the blog...
CVE-2021-24936
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks...
CVE-2021-25110
The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address...
CVE-2021-21630
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2021-25104
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue...
CVE-2020-36760
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect nonce validation on the addcoreextensionsbundlevalidation function. This makes it possible for unauthenticated attackers to validate...
CVE-2020-9246
FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and information protection. Attackers with low privilege can get some extra information. This can lead to information leak...
CVE-2016-11002
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation...
CVE-2013-0243
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections...