4417 matches found
PT-2022-13958
Name of the Vulnerable Software and Affected Versions The Curtain WordPress plugin versions 1.0.0 through 1.0.2 Description The issue is related to the lack of sanitization and escaping of some settings in the plugin, which could allow high privilege users, such as admins, to perform Stored...
PT-2022-13786
Name of the Vulnerable Software and Affected Versions Tabs WordPress plugin versions prior to 2.2.8 Description The issue allows high privileged users with a role as low as editor to perform Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the lack of...
CVE-2022-29222
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection...
Information Disclosure
moodle/moodle is vulnerable to information disclosure. The vulnerability exists in the 'exportfortemplate' function in 'document.php' due lack of sanitization in search results which allows an unauthorized user to view sensitive informations in the system...
D-LINK DIR-825 AC1200 R2 Directory Traversal Vulnerability
The D-LINK DIR-825 AC1200 R2 is a router from China-based AUO D-LINK. The D-LINK DIR-825 AC1200 R2 suffers from a directory traversal vulnerability that stems from a lack of validity checking of paths when processing directory requests, which can be exploited by an attacker to access the entire...
Gitea < 1.16.7 Privilege Escalation Vulnerability
Gitea is prone to a privilege escalation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
JBoss Keycloak CSRF Vulnerability
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...
GHSA-XR6Q-QQX7-553G JBoss Keycloak CSRF Vulnerability
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...
Covid-19 Travel Pass Management System SQL Injection Vulnerability
Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. It provides an online platform for individuals to submit travel passes within the Covid-19 restrictions. The Covid-19 Travel Pass Management System suffers from an SQL injection vulnerability that originates in...
Air Cargo Management System SQL Injection Vulnerability (CNVD-2022-58094)
Air Cargo Management System is an air cargo management system. version 1.0 of Air Cargo Management System is vulnerable to SQL injection, which originates from /acms/admin/?page=transactions/managetransaction& id=Lack of filtering and escaping for parameters, an attacker can use this vulnerabilit...
Cross-site Scripting (XSS)
facturascripts/facturascripts is vulnerable to reflected cross-site scripting. The vulnerability exists in the privateCore function of EditPageOption.php' due to the lack of sanitization which allows an attacker to inject and execute malicious javascript...
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...
CVE-2022-1428: Allocation of Resources Without Limits or Throttling
An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being...
CVE-2022-1631
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain...
CSV Injection
luyadev/yii-helpers is vulnerable to CSV injection. The vulnerability exists due to the lack of sanitization in the item parameter in the generateRow function of ExportHelper.php, allowing an attacker to inject and execute malicious input...
CVE-2022-30292
Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sqreservestack call...
CVE-2022-30292
Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sqreservestack call...
CVE-2022-29968
An issue was discovered in the Linux kernel through 5.17.5. iorwinitfile in fs/iouring.c lacks initialization of kiocb-private...
PT-2022-6789 · Click5 · Sitemap
Name of the Vulnerable Software and Affected Versions: Sitemap by click5 WordPress plugin versions prior to 1.0.36 Description: The issue is related to the lack of authorization and CSRF checks when updating options via a REST endpoint, and the failure to ensure that the option to be updated...