1264 matches found
CVE-2024-3747
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-3334
A security bypass vulnerability exists in the Removable Media Encryption RMEcomponent of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data...
CVE-2024-35633
Server-Side Request Forgery SSRF vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through = 2.0.42...
CVE-2024-30519
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This issue affects Lordicon Animated Icons: from n/a through 2.0.1...
CVE-2024-29813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CartFlows Inc. Funnel Builder by CartFlows allows Stored XSS.This issue affects Funnel Builder by CartFlows: from n/a through 2.0.1...
CVE-2024-31583
Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp...
CVE-2023-51949
Verydows v2.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /protected/controller/backend/rolecontroller...
CVE-2023-28535
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Paytm Paytm Payment Donation plugin = 2.2.0 versions...
CVE-2023-46911
There is a Cross Site Scripting XSS vulnerability in the choosestyletree.do interface of Jspxcms v10.2.0 backend...
CVE-2023-24782
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit...
CVE-2023-26012
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Denzel Chia | Phire Design Custom Login Page plugin = 2.0 versions...
CVE-2023-0624
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...
CVE-2023-5218
Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...
CVE-2023-23630
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...
CVE-2023-27525
An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1...
CVE-2023-6832
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2022-28444
UCMS v1.6 was discovered to contain an arbitrary file read vulnerability...
CVE-2022-45969
Alist v3.4.0 is vulnerable to Directory Traversal,...