CVE-2015-0843

Versions of yubiserver prior to 0.6 are vulnerable to buffer overflows caused by the misuse of the sprintf function. This vulnerability falls under CWE-120 (Buffer Copy without Checking Size of Input). While the technical root cause is identified, specific exploit details are not provided in the ...

CVE-2015-0842

The yubiserver software, in versions prior to 0.6 , is vulnerable to SQL injection issues. This flaw could potentially allow an attacker to achieve an authentication bypass . While technical exploitation details or specific patch versions are not provided in the documents, the vulnerability is as...

CVE-2013-1424

The matplotlib library is vulnerable to a buffer overflow caused by insufficient input validation in certain parsing functions, leading to improper handling of buffer boundaries. An attacker can exploit this by supplying specially crafted input to trigger a memory overwrite, potentially leading t...

CVE-2021-41691

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 . The flaw is caused by the improper handling of the student_id and TRANSFER{SCHOOL] parameters within a POST request sent to the /TransferredOutModal.php endpoint. Successful exploitation allows a remote ...

CVE-2023-5600

Removed by vendor...

CVE-2024-4994

CVE-2024-4994 describes a CSRF vulnerability in GitLab CE/EE affecting multiple release lines: 16.1.0–16.11.4, 17.0.x before 17.0.3, and 17.1.x before 17.1.1. The issue allows execution of arbitrary GraphQL mutations via CSRF on GitLabs GraphQL API. Mitigation is to upgrade to the fixed versions...

TencentOS Server 3: libwebp (TSSA-2023:0051)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0051 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2019-14270

Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox Escape...

CVE-2024-33939

The Masteriyo - LMS WordPress plugin (versions

CVE-2024-2643

The My Sticky Bar (also known as Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any) WordPress plugin versions before 2.6.8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plug...

CVE-2024-3062

The Save as Image Plugin by Pdfcrowd for WordPress (versions prior to 3.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS a...

CVE-2024-1663

The Ultimate Noindex Nofollow Tool II WordPress plugin versions prior to 1.3.6 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform X...

CVE-2024-0852

The coreActivity: Activity Logging plugin for WordPress (versions prior to 1.8.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly escape certain request data when it is outputted back in the admin dashboard. This flaw allows unauthenticated ...

CVE-2023-7228

The illi Link Party! WordPress plugin, specifically version 1.0 and earlier, is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitise and escape certain parameters. This flaw allows unauthenticated visitors to perform XSS att...

CVE-2023-7230

The illi Link Party! WordPress plugin versions 1.0 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain parameters. This vulnerability allows users with a role as low as admin to execute XSS attacks. To remediate th...

CVE-2023-7229

The illi Link Party! WordPress plugin, affecting version 1.0 and earlier, contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists because the plugin lacks proper CSRF checks when updating its settings, which could allow an attacker to modify these settings via a logged-in admi...

CVE-2023-7196

The Ultimate Noindex Nofollow Tool WordPress plugin, in versions 1.1.2 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker to force a logged-in administrator to modify these...

CVE-2023-7195

The WP-Reply Notify WordPress plugin (versions 1.1 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. An attacker could leverage this to perform unauthorized configuration changes on behalf of a logged-in administrator. T...

CVE-2023-7197

The Marketing Twitter Bot WordPress plugin, in versions 1.11 and earlier , is susceptible to a vulnerability where a lack of CSRF checks , combined with missing sanitization and escaping, allows attackers to force logged-in administrators to add Stored XSS payloads via a CSRF attack . To mitigate...

CVE-2023-7088

The Add SVG Support for Media Uploader | inventivo WordPress plugin, affecting versions 1.0.0 through 1.0.5 , contains a vulnerability where uploaded SVG files are not properly sanitized. This allows users with privileges as low as Author to upload malicious SVG files containing XSS payloads , po...