9966 matches found
Security Bulletin: Vulnerabilities in Java affects IBM Cloud Application Business Insights - Quaterly Java update, CVE-2021-35603 and CVE-2021-35550
Summary Vulnerabilities in Java affects IBM Cloud Application Business Insights - Quaterly Java update, CVE-2021-35603 and CVE-2021-35550 Vulnerability Details CVEID:CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated...
Dahua software products 授权问题漏洞
Dahua software products are a family of applications from Dahua Corporation of China. A security vulnerability exists in a number of Dahua software products, which can be exploited by an unauthenticated attacker to obtain traceroute results using a remote DSS server by sending specially crafted...
CVE-2022-46764
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 fixed in 5.2.6.10025 allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution...
Dahua software products 授权问题漏洞
Dahua software products are a family of applications from Dahua Corporation of China. A security vulnerability exists in several Dahua software products that stems from an unrestricted ICMP request from its remote DSS server that allows an unauthenticated attacker to bypass firewall access contro...
CVE-2022-4106
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...
CVE-2022-4125
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well...
Cross site request forgery (csrf)
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users along with their posts...
PT-2022-25302 · WordPress · Registration Forms
Name of the Vulnerable Software and Affected Versions: Registration Forms WordPress plugin versions prior to 3.8.1.3 Description: The issue allows unauthenticated attackers to delete arbitrary users, along with their posts, due to a lack of authorisation and CSRF protection when deleting users vi...
Authorization
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
CVE-2022-4555 WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
CVE-2022-4555
The CVE-2022-4555 issue affects the WP Shamsi WordPress plugin (
CVE-2022-4555
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
PT-2022-28033 · Unknown · Puhttpsniff
Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned in the provided descriptions. Description: The "puhttpsniff" service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker ...
CVE-2022-3427
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
Cross site request forgery (csrf)
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
CVE-2022-3427 Corner Ad <= 1.0.56 - Cross-Site Request Forgery
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
Input validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters inpu...
CVE-2022-4171 demon image annotation <= 5.0 - Improper Input Restriction Validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters inpu...
PT-2022-26039 · WordPress · Demon Image Annotation Plugin
Name of the Vulnerable Software and Affected Versions: demon image annotation plugin for WordPress versions up to, and including 5.0 Description: The issue arises from improper input validation in the plugin, specifically when handling the number of characters supplied during an annotation. Despi...