10482 matches found
Malicious Package
Overview ceedee is a malicious package. This is a "dependency confusion" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users into downloading the package which contains a malicious code. This package exfiltrates user data such...
PT-2025-49619
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1-rc1 Description A memory leak exists in the Linux kernel related to worker creation within the io-wq subsystem. Specifically, if CPU mask allocation for a node fails, the memory allocated for the io wqe struc...
Mantenimiento Web < 0.14 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2025-38182
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists within the CIFS implementation when building the NTLMSSP negotiate blob fails during session setup. Specifically, the session setup request is not freed, leading to ...
Cross site scripting
The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-3139 We’re Open! < 1.42 - Admin+ Stored Cross-Site Scripting
The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-20726 · WordPress · We’Re Open!
Name of the Vulnerable Software and Affected Versions: We’re Open! WordPress plugin versions prior to 1.42 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...
Highlight Focus <= 1.1 - Admin+ Stored Cross Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in any of the plugin...
Accessibility < 1.0.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
AB Press Optimizer <= 1.1.1 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-36676 · Git +1 · Fluent-Bit
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 3 crash has been reported. The crash involves the onig node str cat function and occurs during the setup tree process. No...
CVE-2022-2981
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...
CVE-2022-2981
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...
Cross site scripting
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for examp...
CVE-2022-3136 Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CWA for HTML5 "Multi-Monitor setup requires permission" message appears even with single monitor
Below message is seen after launching a session using the HTML5 client .Multi-monitor setup requires permission Do you want to give permission to use multiple monitors? The message is seebn even though there is only 1 monitor on the client device...
Rock Convert < 2.11.0 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Go to the plugin's settings Popup tab, click o...
eu.lundegaard.liferay:liferay-db-setup-core (>=3.1.0, <=3.2.0) potentially affected by CVE-2022-41414 via com.liferay.portal:com.liferay.portal.impl (5.13.3)
com.liferay.portal:com.liferay.portal.impl MAVEN version 5.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core =3.1.0, =3.2.0 Source cves:...
eu.lundegaard.liferay:liferay-db-setup-core (3.0.0) potentially affected by CVE-2022-41414 via com.liferay.portal:com.liferay.portal.impl (4.2.5)
com.liferay.portal:com.liferay.portal.impl MAVEN version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core 3.0.0 Source cves: CVE-2022-414...