The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the executi...
AFFECTED_PRODUCTS:
Codevibrant Wp Blog Post Layouts
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. Thi...
AFFECTED_PRODUCTS:
Posimyth The Plus Addons For Elementor
The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child the...
AFFECTED_PRODUCTS:
Wensolutions Wp Child Theme Generator
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access...
AFFECTED_PRODUCTS:
Wprepublic Hide Dashboard Notifications
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with adm...
AFFECTED_PRODUCTS:
Wpexperts License Manager For Woocommerce
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen...
A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file add-item.php. The manipulation of the argument price leads to sql injection. The attack can be initiated remotely. The exploit has be...
AFFECTED_PRODUCTS:
Oretnom23 Food Ordering Management System
A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file login.php of the component Login Panel. The manipulation of the argument username leads to sql injection. It is possible to initiate the...
AFFECTED_PRODUCTS:
Oretnom23 Food Ordering Management System
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. Affected by this issue is the function get_student of the file student_form.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The...
AFFECTED_PRODUCTS:
Oretnom23 Simple Student Attendance System
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple*...
AFFECTED_PRODUCTS:
Authzed Spicedb
The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be...
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable th...
AFFECTED_PRODUCTS:
Xwiki Xwiki,
Xwiki Xwiki,
Xwiki Xwiki
... (+3)
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.
AFFECTED_PRODUCTS:
Westermo L210 F2g Lynx Firmware
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.
AFFECTED_PRODUCTS:
Westermo L210 F2g Firmware
A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Serve...
AFFECTED_PRODUCTS:
GitHub Enterprise Server,
GitHub Enterprise Server,
GitHub Enterprise Server
... (+1)
Plain text credentials and session ID can be captured with a network sniffer.
AFFECTED_PRODUCTS:
Westermo L210 F2g Firmware
Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.
AFFECTED_PRODUCTS:
Samsung Magician
A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute arbitrary code via the Borrower Name, Department, and Remarks parameters.
AFFECTED_PRODUCTS:
Oretnom23 Computer Laboratory Management System
Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the version parameter.
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by...
AFFECTED_PRODUCTS:
Anujk305 Daily Expenses Management System
Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target gue...
AFFECTED_PRODUCTS:
Parallels Parallels Desktop
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target ho...
AFFECTED_PRODUCTS:
Parallels Parallels Desktop
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...
AFFECTED_PRODUCTS:
HP Poly Plantronics Hub
Microsoft Edge (Chromium-based) Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge
Microsoft Edge (Chromium-based) Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue...
AFFECTED_PRODUCTS:
Strapi Strapi
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration.
In SFTPGo versions prior to v2.6.1, if the feature is enabled,...
An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.
Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
AFFECTED_PRODUCTS:
Moodle Moodle
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06 that allows
attackers with system administrator permissions to interfere with other system
administrators’ use of the management UI when the second administrator accesses
the vulnerabl...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the second administrator later
edits the same management...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the policy
management UI of Absolute Secure Access prior to version 13.06. Attackers can
interfere with a system administrator’s use of the policy management UI when
the attacker convinces the victim administrator to follow a crafted link to the
vulne...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the victim administrator edits
the same management object...
AFFECTED_PRODUCTS:
Absolute Secure Access
A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the vif_enable function.
AFFECTED_PRODUCTS:
Totolink A6000r Firmware
There is a cross-site
scripting vulnerability in the management UI of Absolute Secure Access prior to
version 13.06. Attackers with system administrator permissions can interfere
with another system administrator’s use of the management UI when the second
administrator later edits the same managemen...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the pool
configuration component of the management UI of Absolute Secure Access prior to
13.06. Attackers with system administrator permissions can pass a limited
length script to be run by another administrator. The scope is unchanged, there
is no lo...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is an insufficient input validation vulnerability in
the Warehouse component of Absolute Secure Access prior to 13.06. Attackers
with system administrator permissions can impair the availability of certain
elements of the Secure Access administrative UI by writing invalid data to the
warehouse...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the Secure
Access administrative UI of Absolute Secure Access prior to version 13.06.
Attackers can pass a limited-length script to the administrative UI which is
then stored where an administrator can access it. The scope is unchanged, there
is no lo...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the Policy
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with another system
administrator’s use of the policy management UI when the administrators are
editing the same p...
AFFECTED_PRODUCTS:
Absolute Secure Access
There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.06.
Attackers with valid tunnel credentials can pass a limited-length script to the
administrative console which is then temporarily stored where an administrator
u...
AFFECTED_PRODUCTS:
Absolute Secure Access