PT-2025-5457 · Unknown · Wpgear Import Excel To Gravity Forms

Name of the Vulnerable Software and Affected Versions: WPGear Import Excel to Gravity Forms versions 1.18 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables...

CVE-2024-54215

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through = 1.18...

WordPress plugin Revy 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-54214

Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a through = 1.18...

CVE-2024-54214

CVE-2024-54214 describes an unrestricted/unauthenticated upload of files with dangerous types in the WordPress Revy plugin (versions <= 1.18). The vulnerability enables uploading a web shell to the web server, with CVSSv3.1 score reported as 10.0 (critical). Public references in connected docs...

WordPress 코드엠샵 소셜톡 plugin <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via addplusfriends and addplustalk Shortcodes vulnerability discovered by Peter Thaleikis in WordPress Plugin 코드엠샵 소셜톡 versions = 1.1.18...

Original texts Yandex WebMaster <= 1.18 - Cross-Site Request Forgery

Description The Original texts Yandex WebMaster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.18. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an...

CVE-2023-37564

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier,...

PT-2023-26021 · Elecom · Elecom Wrc-1167Febk-A +11

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers versions v1.03 and earlier ELECOM WRC-1167GHBK-S versions v1.03 and earlier ELECOM WRC-1167GEBK-S versions v1.03 and earlier ELECOM WRC-1167FEBK-S versions v1.04 and earlier ELECOM WRC-1167GHBK3-A versions v1.24 an...

CVE-2016-15026

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The pat...

GHSA-4JX2-HVQW-93J9 dd-plist XML External Entitly vulnerability

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The nam...

Xxe

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The pat...

SUSE CVE-2021-23901

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...

SUSE CVE-2022-27536

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...

Russian Hackers Using Graphiron Malware to Steal Data from Ukraine

A Russia-linked threat actor has been observed deploying a new information-stealing malware in cyber attacks targeting Ukraine. Dubbed Graphiron by Broadcom-owned Symantec, the malware is the handiwork of an espionage group known as Nodaria, which is tracked by the Computer Emergency Response Tea...

PT-2023-18518 · Tokio · Tokio

Name of the Vulnerable Software and Affected Versions: Tokio versions 1.7.0 through 1.18.3 Tokio versions 1.18.4 through 1.20.2 Tokio versions 1.20.3 through 1.23.0 Description: When configuring a Windows named pipe server, setting pipe mode will reset reject remote clients to false. If the...

OESA-2022-1830 golang security update

The Go Programming Language Security Fixes: A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. References: https://go.dev/issue/53871...

CVE-2022-29526

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress underConstruction plugin in version 1.18...

PT-2020-15485 · Jenkins · Jenkins Perfecto Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Perfecto Plugin versions 1.17 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials,...