Customer Reviews for WooCommerce Plugin for WordPress < 5.17.0 Cross-Site Scripting

The WordPress Customer Reviews for WooCommerce Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

RHEL 8 : pki-core:10.6 (RHSA-2023:1747)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1747 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: access to...

Siemens SCALANCE W1750D Command Injection (CVE-2021-25146)

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aru...

Siemens SCALANCE W1750D Improper Input Validation (CVE-2021-25157)

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba...

Siemens SCALANCE W1750D Improper Neutralization of Input During Web Page Generation (CVE-2022-37892)

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

Siemens SCALANCE XCM332 Allocation of Resources Without Limits or Throttling (CVE-2022-32206)

curl 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited...

Siemens SCALANCE W1750D Improper Limitation of a Pathname to a Restricted Directory (CVE-2021-37734)

A remote unauthorized read access to files vulnerability was discovered in Aruba Instant versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 a...

Siemens SCALANCE W1750D Command Injection (CVE-2021-25150)

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aru...

SPIP CMS 4.0.x < 4.0.5 Multiples Vulnerabilities

According to its self-reported version, the instance of SPIP CMS running on the remote web server is prior to 3.2.14 or 4.0.x prior to 4.0.5. It is, therefore, affected by multiples vulnerabilities : - A Remote Code Execution - Unauthenticated access to information about editorial objects. Note...

ManageEngine OpManager 12.6.x < 12.6.141 / 12.6.154 / 12.6.169 XML External Entity

The version of ManageEngine OpManager running on the remote web server is 12.6.x prior to 12.6.141 / 12.6.154 / 12.6.169. It is, there, affected by an XML external entity vulnerability. A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality. A specially crafted X...

SPIP CMS 4.0.x < 4.0.8 Remote Code Execution

According to its self-reported version, the instance of SPIP CMS running on the remote web server is prior to 3.2.16 or 4.0.x prior to 4.0.8 or 4.1.X prior to 4.1.5. It is, therefore, affected by an Remote Code Execution via the oups parameter. Note that the scanner has not tested for these issue...

Apache Tomcat 9.0.0-M1 < 9.0.72 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.86, 9.0.0-M1 prior to 9.0.72, 10.1.0-M1 prior to 10.1.6 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by an information disclosure due to the RemoteIpFilter. Note that the scanner has not attempted to...

OpenSSL 3.1.0 < 3.1.1 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.1.1 advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary:...

Atlassian Jira < 7.13.13 Xss In MigratePriorityScheme Resource

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.13. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in th...

Atlassian Jira 7.2.0 < 8.18.1 Remote Code Execution In Workflow Import

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.19.0. It is, therefore, affected by a vulnerability which allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrar...

RHEL 9 : lua (RHSA-2023:1211)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1211 advisory. The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also...

Apache 2.4.x < 2.4.56 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.56. It is, therefore, affected by multiple vulnerabilities: - Some modproxy configurations allow a HTTP Request Smuggling attack. CVE-2023-25690 - HTTP Response Smuggling vulnerability via modproxyuwsg...

Atlassian Jira 8.14.0 < 8.17.0 Export HTML Report Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.12 or 8.14.x prior to 8.16.1. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripti...

Atlassian Jira 8.6.x < 8.13.6 Export HTML Report Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.12 or 8.14.x prior to 8.16.1. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripti...

Atlassian Jira 8.14.x < 8.14.1 Anonymous Whitelist Rules Leakage

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.3 or 8.14.x prior to 8.14.1. It is, therefore, affected by a Broken Access Control vulnerability that allows anonymous remote attackers to view whitelist rules in the...