14727 matches found
CVE-2022-2965
Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7...
CVE-2022-2965
CVE-2022-2965 affects notrinos/notrinoserp (a PHP/MySQL web ERP) prior to version 0.7. The root cause is improper restriction of rendered UI layers/frames (missing X-Frame-Options), enabling clickjacking that could lead to actions such as deleting a user account from the admin context. Public sou...
PT-2022-6883 · Oracle +1 · Virtualbox +1
Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.38 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can allow an attacker to gain unauthorized access to protected information...
PT-2022-4454 · Unknown · Workstation
Name of the Vulnerable Software and Affected Versions: WorkstationST versions prior to 07.09.15 Description: A reflected cross-site scripting XSS vulnerability exists in the iHistorian Data Display of WorkstationST, which could allow an attacker to compromise a victim's browser. The vulnerability...
PT-2022-23318 · Akash Soni · As – Create Pinterest Pinboard Pages
Name of the Vulnerable Software and Affected Versions: Akash soni's AS – Create Pinterest Pinboard Pages plugin version 1.0 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This occurs when a subscriber or higher can change plugin...
PT-2022-4433 · WordPress · Yotuwp Video Gallery
Name of the Vulnerable Software and Affected Versions: yotuwp Video Gallery plugin versions 1.3.4.5 and earlier Description: The issue is related to a Broken Authentication vulnerability in the yotuwp Video Gallery plugin for WordPress. This vulnerability is associated with weaknesses in the...
Design/Logic Flaw
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based download blocking restrictions...
CVE-2022-2362
CVE-2022-2362 affects the WordPress Download Manager plugin (versions prior to 3.2.50). The root cause is the plugin prioritizing certain HTTP headers over PHP’s REMOTE_ADDR to identify visitor IPs, enabling bypass of IP-based download-block restrictions. Affected product: WordPress Download Mana...
PT-2022-15062 · WordPress · Linkworth
Name of the Vulnerable Software and Affected Versions: LinkWorth WordPress plugin versions prior to 3.3.4 Description: The issue is related to the lack of nonce checks in the LinkWorth WordPress plugin, which could allow attackers to perform a CSRF attack. This attack could enable an attacker to...
PT-2022-21710 · Unknown +1 · Wwbn Avideo +1
Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A SQL injection issue exists in the ObjectYPT functionality, specifically within the Live Schedules plugin. This allows an attacker to inject SQL by manipulating the title parameter in a specially-crafte...
PT-2025-25928
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc5 for upstream min debug 2022 05 05 10 13 Description The issue is related to an asymmetry in setting and clearing the MLX5 LAG FLAG NDEVS READY flag in the Linux kernel's net/mlx5 module. This can lead ...
PT-2022-15655 · WordPress · Wp Edit Menu
Name of the Vulnerable Software and Affected Versions: WP Edit Menu WordPress plugin versions prior to 1.5.0 Description: The issue concerns a lack of CSRF protection in an AJAX action, which could allow attackers to make a logged-in admin delete arbitrary posts or pages from the blog via a CSRF...
PT-2022-20631 · Dell · Dell Powerscale Onefs
Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.2.0 through 9.2.1.12 Dell PowerScale OneFS version 9.3.0.5 Description: The issue is related to an improper preservation of permissions in SyncIQ, which could allow a low-privileged local attacker to potential...
DoS via Client Email Update
Description An unauthenticated user, via the Inbox Website Widget, can update its contact email information, whose field doesn't have any proper size restriction or limitation in place, allowing to set as email an unlimited number of characters. \ \ Because of this an attacker can send an enormou...
CVE-2022-36030 SQL Injection in Project-nexus
Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of user input. This issue has not yet been patched. Users are advised to restrict user input and to upgrade when a new release becomes available...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Intelligent Operations Center products (CVE-2016-0385)
Summary IBM WebSphere Application Server is shipped as a component of IBM Intelligent Operations Center and related products. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-0385...
PT-2022-23128 · Unknown · Project-Nexus
Name of the Vulnerable Software and Affected Versions: Project-nexus affected versions not specified Description: The issue is related to SQL injection due to a lack of sanitization of user input. This allows for potential exploitation. Users are advised to restrict user input. There is no...
CVE-2022-28858
Improper buffer restriction in the firmware for some IntelR NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access...