Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database ca...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A local high privileged attacker could potentially exploit this vulnerability, to bypass security restrictions. Exploitation may lead to a...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. A local high privileged attacker could potentially exploit this vulnerability, to gain unauthorized read and write access to the OS files stored on the server filesyst...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
AFFECTED_PRODUCTS:
Eyoucms Eyoucms
A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
AFFECTED_PRODUCTS:
Rpcms Rpcms
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
AFFECTED_PRODUCTS:
Pluck-Cms Pluck
Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
AFFECTED_PRODUCTS:
Sem-Cms Semcms
EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.
AFFECTED_PRODUCTS:
Leadscloud Empirecms
PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
AFFECTED_PRODUCTS:
Popojicms Popojicms
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9.
AFFECTED_PRODUCTS:
Brainstormforce Spectra
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a throug...
AFFECTED_PRODUCTS:
Automattic Woopayments
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from...
AFFECTED_PRODUCTS:
Pencidesign Soledad
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.
AFFECTED_PRODUCTS:
Spiffyplugins Spiffy Calendar
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.
AFFECTED_PRODUCTS:
Plugin-Planet Dashboard Widget Suite
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Reflected XSS.This issue affects Seraphinite Accelerator: from n/a through 2.20.28.
AFFECTED_PRODUCTS:
S-Sols Seraphinite Accelerator
Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23.
AFFECTED_PRODUCTS:
Ideabox Powerpack Addons For Elementor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo,...
AFFECTED_PRODUCTS:
Wordplus Better Messages
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's un...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Reflected XSS.This issue affects Stock Ticker: from n/a through 3.23.2.
AFFECTED_PRODUCTS:
Urosevic Stock Ticker
Command Injection in GitHub repository gradio-app/gradio prior to main.
AFFECTED_PRODUCTS:
Gradio Project Gradio
The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia.
AFFECTED_PRODUCTS:
Beckhoff Authelia Bhf
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
AFFECTED_PRODUCTS:
Phoenixcontact Multiprog,
Phoenixcontact Proconos Eclr
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.
AFFECTED_PRODUCTS:
Livemeshthemes Wpbakery Page Builder Addons
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or later for WooCommerce allows Stored XSS.This issue affects Alma – Pay in installments or later for WooCommerce: from n/a through 5.1.3.
AFFECTED_PRODUCTS:
Almapay Alma
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.2.
AFFECTED_PRODUCTS:
Averta Shortcodes And Extra Features For Phlox Theme
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
AFFECTED_PRODUCTS:
Twinpictures Annual Archive
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.17.
AFFECTED_PRODUCTS:
Bearne Author Avatars List\/block
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affects Cookie Bar: from n/a through 2.0.
AFFECTED_PRODUCTS:
Brontobytes Cookie Bar
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943.
AFFECTED_PRODUCTS:
Acronis Agent
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
AFFECTED_PRODUCTS:
Phoenixcontact Axc F 2152 Firmware,
Phoenixcontact Plcnext Engineer,
Phoenixcontact Rfc 4072s Firmware
... (+6)
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
AFFECTED_PRODUCTS:
Phoenixcontact Axc 1050 Firmware,
Phoenixcontact Automationworx Software Suite,
Phoenixcontact Config\+
... (+15)
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.
AFFECTED_PRODUCTS:
Phoenixcontact Axc F 2152 Firmware,
Phoenixcontact Plcnext Engineer,
Phoenixcontact Rfc 4072s Firmware
... (+6)
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
AFFECTED_PRODUCTS:
Phoenixcontact Axc 1050 Firmware,
Phoenixcontact Automationworx Software Suite,
Phoenixcontact Config\+
... (+15)
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks the attacker could perform operations on the PC under the user's authority. IBM X-Force ID: 268273.
AFFECTED_PRODUCTS:
IBM I Access Client Solutions,
IBM I Access Client Solutions
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Forc...
AFFECTED_PRODUCTS:
IBM I Access Client Solutions,
IBM I Access Client Solutions
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
AFFECTED_PRODUCTS:
Phoenixcontact Multiprog,
Phoenixcontact Proconos Eclr
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
AFFECTED_PRODUCTS:
Kubeflow Kubeflow
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
AFFECTED_PRODUCTS:
Kubeflow Kubeflow
External Control of File Name or Path in h2oai/h2o-3
AFFECTED_PRODUCTS:
H2O H2o
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows Stored XSS.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPr...
AFFECTED_PRODUCTS:
Pagevisitcounter Advanced Page Visit Counter
@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
AFFECTED_PRODUCTS:
Adobe Css Tools
SQLi vulnerability in Starshop component for Joomla.
AFFECTED_PRODUCTS:
Joomstar Starshop
SQLi vulnerability in S5 Register module for Joomla.
AFFECTED_PRODUCTS:
Joomlart S5 Register
SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run().
AFFECTED_PRODUCTS:
Buy-Addons Bavideotab
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
AFFECTED_PRODUCTS:
Apache Shiro,
Apache Shiro
SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods.
AFFECTED_PRODUCTS:
Sunnytoo Sturls
A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
AFFECTED_PRODUCTS:
Joomboost Easy Quick Contact
A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.
AFFECTED_PRODUCTS:
Deconf Clicky Analytics Dashboard
A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.
AFFECTED_PRODUCTS:
Artio Joomdoc