CVE-2022-0493

CVE-2022-0493 affects the WordPress String Locator plugin prior to version 2.5.0. The vulnerability arises from insufficient validation of the file path during searches, permitting high-privilege users (e.g., admin) to perform path traversal and query arbitrary files on the web server. Additional...

CVE-2022-0493 String Locator < 2.5.0 - Admin+ Arbitrary File Read

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be...

WordPress plugin String locator 路径遍历漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress String locator plugin version 2.5.0 before the path traversal vulnerability, the vulnerability is derived from String locato...

WordPress String locator plugin <= 2.4.2 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by qerogram in WordPress String locator plugin versions = 2.4.2. Solution Update the WordPress String locator plugin to the latest available version at least 2.5.0...

WordPress VO Store Locator – WP Store Locator Plugin plugin <= 3.3.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress VO Store Locator – WP Store Locator Plugin plugin versions = 3.3.0. Solution No patched version available...

WordPress WP Store Locator – Extenders plugin < 1.3.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Store Locator – Extenders plugin versions 1.3.1. Solution Update the WordPress WP Store Locator – Extenders plugin to the latest available version at least 1.3.1...

WordPress Store Locator Plus® – Gravity Forms Locations plugin < 5.9.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Store Locator Plus® – Gravity Forms Locations plugin versions 5.9.1. Solution Update the WordPress Store Locator Plus® – Gravity Forms Locations plugin to the latest available version at least 5.9.1...

WordPress Store Locator Plus® – Gravity Forms Locations plugin < 5.9.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Store Locator Plus® – Gravity Forms Locations plugin versions 5.9.1. Solution Update the WordPress Store Locator Plus® – Gravity Forms Locations plugin to the latest available version at least 5.9.1...

WordPress WP Store Locator – Extenders plugin < 1.3.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Store Locator – Extenders plugin versions 1.3.1. Solution Update the WordPress WP Store Locator – Extenders plugin to the latest available version at least 1.3.1...

WordPress VO Store Locator – WP Store Locator Plugin plugin <= 3.3.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress VO Store Locator – WP Store Locator Plugin plugin versions = 3.3.0. Solution No patched version available...

A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1 3.9.5 3.8.11 3.7.11 and 3.6.14.

...

CVE-2022-21373

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite component: Reseller Locator. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner...

Code injection

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite component: Reseller Locator. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner...

CVE-2022-21373

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite component: Reseller Locator. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Partner...

CVE-2022-21373

CVE-2022-21373 affects Oracle E-Business Suite Partner Management (Reseller Locator). Affected versions are 12.2.3–12.2.11. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Partner Management, with human interaction required. Impacts include unauthor...

USN-5195-2 mumble vulnerability

It was discovered that the Mumble client supported websites for public servers with arbitrary URL schemes. If a user were tricked into visiting a malicious website from the public server list, a remote attacker could possibly execute arbitrary code...

CVE-2021-42563

There is an Unquoted Service Path in NI Service Locator nisvcloc.exe in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges...

CVE-2021-42563

There is an Unquoted Service Path in NI Service Locator nisvcloc.exe in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges...

Design/Logic Flaw

There is an Unquoted Service Path in NI Service Locator nisvcloc.exe in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges...

CVE-2021-42563

There is an Unquoted Service Path in NI Service Locator nisvcloc.exe in versions prior to 18.0 on Windows. This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges...