11782 matches found
GHSA-JQ35-85CJ-FJ4P vulnerabilities
Vulnerabilities for packages: chartmuseum, kpt, up, kubescape, k3d, ctop, falcoctl-fips, paranoia, scorecard, tekton-chains, slsa-verifier, k3s, aactl, skaffold, bom, spire-server-fips...
CVE-2023-5335
The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
CVE-2023-46153
Unauth. Stored Cross-Site Scripting XSS vulnerability in UserFeedback Team User Feedback plugin = 1.0.9 versions...
PT-2023-32360 · Unknown · Nanning Ontall Longxing Industrial Development Zone Project Construction/Installation Management System
Name of the Vulnerable Software and Affected Versions: Nanning Ontall Longxing Industrial Development Zone Project Construction and Installation Management System versions up to 20231026 Description: A critical issue has been found in the system, affecting an unknown functionality of the file...
CVE-2023-46090
creationtimestamp| type| source ---|---|--- 2023-10-26 18:16:05+00:00| seen| https://t.me/cibsecurity/72973...
potential DOS cause of rounding up at rayMul and rayDiv
Lines of code Vulnerability details Impact In rayMul and rayDiv , there is always rounding up ,cause of that , there will be potential DOS Proof of Concept function normalizeAmount MarketState memory state, uint256 amount internal pure returns uint256 return amount.rayMulstate.scaleFactor; functi...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: kubeflow-fips, up, kubescape, spark-operator, k3d, kubernetes-csi-livenessprobe-fips, terraform-provider-sendgrid-fips, falcoctl-fips, scorecard, vault-csi-provider, src, kubevela, aactl, dgraph, dynamic-localpv-provisioner-fips, plutono-fips, conftest-fips,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: cortex, terraform-provider-sendgrid, kubeflow, kubevela, dgraph, kubescape, slsa-verifier, k3d, buildkitd, src, spark-operator, aactl, scorecard, up...
IDAttend IDWeb SQL Injection Vulnerability
IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in the IDAttend IDWeb application version 3.1.052 and prior versions, which stems from an unauthenticated SQL injection in the GetVisitors method...
PT-2023-29821 · WordPress · Osmansorkar Ajax Archive Calendar Plugin
Name of the Vulnerable Software and Affected Versions: Osmansorkar Ajax Archive Calendar plugin versions = 2.6.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no...
PT-2023-32275 · Viessmann · Viessmann Vitogate 300
Name of the Vulnerable Software and Affected Versions: Viessmann Vitogate 300 versions up to 2.1.3.0 Description: A vulnerability was found in the Viessmann Vitogate 300, affecting some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been...
CVE-2020-36755
The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonce validation on the czrfnpostfieldssave function. This makes it possible for unauthenticated attackers to post fields via a forged request...
CVE-2023-45883
A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM...
Former Uber CISO Appealing His Conviction
Joe Sullivan, Ubers CEO during their 2016 data breach, is appealing his conviction. Prosecutors charged Sullivan, whom Uber hired as CISO after the 2014 breach, of withholding information about the 2016 incident from the FTC even as its investigators were scrutinizing the companys data security a...
CVE-2023-45628
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in QROkes QR Twitter Widget plugin = 0.2.3 versions...
CVE-2023-30781
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Theme Blvd Tweeple plugin = 0.9.5 versions...
CVE-2023-45073
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Michael Koch Mendeley Plugin plugin = 1.3.2 versions...
AZL-31584 CVE-2023-22111 affecting package mysql for versions less than 8.0.34-1
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: UDF. Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...
