The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pa...
AFFECTED_PRODUCTS:
Auctionplugin Ultimate Auction
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Co...
AFFECTED_PRODUCTS:
Vanokhin Shortcodes Ultimate
There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules.
AFFECTED_PRODUCTS:
Docusnap Docusnap
The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...
AFFECTED_PRODUCTS:
Wpsc-Plugin Structured Content
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escapi...
AFFECTED_PRODUCTS:
Master-Addons Master Addons
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping...
AFFECTED_PRODUCTS:
Master-Addons Master Addons
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own...
AFFECTED_PRODUCTS:
Wpswings Wallet System For Woocommerce
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php....
AFFECTED_PRODUCTS:
Wpswings Wallet System For Woocommerce
Vulnerability of improper access permission in the process management module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Vulnerability of improper access permission in the HDC module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Permission verification vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Multi-thread problem vulnerability in the package management module
Impact: Successful exploitation of this vulnerability may affect availability.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Permission verification vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Permission management vulnerability in the lock screen module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Multi-concurrency vulnerability in the media digital copyright protection module
Impact: Successful exploitation of this vulnerability may affect availability.
AFFECTED_PRODUCTS:
Huawei Harmonyos
Permission verification bypass vulnerability in the notification module
Impact: Successful exploitation of this vulnerability may affect availability.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Emui
... (+7)
Permission bypass vulnerability in the window module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AFFECTED_PRODUCTS:
Huawei Emui,
Huawei Emui,
Huawei Emui
... (+7)
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
AFFECTED_PRODUCTS:
Nakivo Backup \& Replication Director
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework.
Axis has released patched AXIS OS versions for the highlighted flaw. Please ref...
Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not affecte...
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory.Â
Axis has released patched AXIS OS versions for the highl...
Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files to the Axis device with the purpose to exhaust system resources.
Axis...
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
AFFECTED_PRODUCTS:
Wpase Admin And Site Enhancements
A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit...
AFFECTED_PRODUCTS:
Phpgurukul Restaurant Table Booking System
A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file employee.php. The manipulation of the argument Full Name leads to cross site scripting. It is possible to initiate the attack remotely. The explo...
AFFECTED_PRODUCTS:
Remyandrade Employee Management System
A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionality of the file /Blood/A+.php. The manipulation of the argument Availibility leads to cross site scripting. The attack may be launched remotel...
AFFECTED_PRODUCTS:
Code-Projects Blood Bank System
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and ab...
AFFECTED_PRODUCTS:
Spicethemes Newscrunch
The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload ar...
AFFECTED_PRODUCTS:
Spicethemes Newscrunch
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
AFFECTED_PRODUCTS:
Openatom Openharmony