The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
AFFECTED_PRODUCTS:
Implecode Ecommerce Product Catalog
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
AFFECTED_PRODUCTS:
Welcart Welcart E Commerce
The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog
AFFECTED_PRODUCTS:
Welcart Welcart E Commerce
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Welcart Welcart E Commerce
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
AFFECTED_PRODUCTS:
Back2Nature Word Balloon
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Ays-Pro Popup Box
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Ays-Pro Popup Box
The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges.
AFFECTED_PRODUCTS:
Filr Project Filr
The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Amp-Cloud Amp Plus
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Bannersky Bsk Contact Form 7 Blacklist
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
AFFECTED_PRODUCTS:
Shooflysolutions Simply Excerpts
The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
AFFECTED_PRODUCTS:
Alphabpo Easy Newsletter Signups
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
AFFECTED_PRODUCTS:
Najeebmedia Frontend File Manager Plugin
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
AFFECTED_PRODUCTS:
Uploading Svg\, Webp And Ico Files Project Uploading Svg\, Webp And Ico Files
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information....
AFFECTED_PRODUCTS:
Jupyter Jupyter Server
Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6...
AFFECTED_PRODUCTS:
Traefik Traefik,
Traefik Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This...
AFFECTED_PRODUCTS:
Traefik Traefik,
Traefik Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path an...
AFFECTED_PRODUCTS:
Traefik Traefik,
Traefik Traefik
Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.
AFFECTED_PRODUCTS:
Noear Solon,
Noear Solon
Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
AFFECTED_PRODUCTS:
Microcks Microcks
An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.
AFFECTED_PRODUCTS:
Thinkadmin Thinkadmin
An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file.
AFFECTED_PRODUCTS:
Thinkadmin Thinkadmin
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below.
Incomplete or wrong received APDU frame layout may
cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer
with wrong length inform...
AFFECTED_PRODUCTS:
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware
... (+25)
A vulnerability exists in the webserver that affects the
RTU500 series product versions listed below. A malicious
actor could perform cross-site scripting on the webserver
due to an RDT language file being improperly sanitized.
AFFECTED_PRODUCTS:
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware
... (+25)
A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
AFFECTED_PRODUCTS:
Grocy Project Grocy
kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
AFFECTED_PRODUCTS:
Keking Kkfileview,
Keking Kkfileview
EzViz Studio v2.2.0 is vulnerable to DLL hijacking.
AFFECTED_PRODUCTS:
Ezviz Ezviz Studio
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this i...
AFFECTED_PRODUCTS:
Google Cloud Firestore
SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to...
AFFECTED_PRODUCTS:
Sem-Cms Semcms
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
AFFECTED_PRODUCTS:
Totolink X6000r Firmware
TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
AFFECTED_PRODUCTS:
Totolink X6000r Firmware
Out-of-bounds Write vulnerability in Arm Ltd Midgard GPU Userspace Driver, Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a local non-privileged user to write a constant pattern to a limited amount of memory no...
AFFECTED_PRODUCTS:
Arm Bifrost Gpu Kernel Driver,
Arm Midgard Gpu Kernel Driver,
Arm Valhall Gpu Kernel Driver
... (+1)
A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
AFFECTED_PRODUCTS:
Qos Logback,
Qos Logback,
Qos Logback
Dell DM5500 contains a path traversal vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability to overwrite configuration files stored on the server filesystem.
AFFECTED_PRODUCTS:
Dell Dm5500 Firmware
Dell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in the appliance. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.
AFFECTED_PRODUCTS:
Dell Dm5500 Firmware
Dell DM5500 contains a privilege escalation vulnerability in the appliance. A remote attacker with low privileges could potentially exploit this vulnerability to escape the restricted shell and gain root access to the appliance.
AFFECTED_PRODUCTS:
Dell Dm5500 Firmware
Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access of resources or functionality that could possibly lead to execute arbitrary code.
AFFECTED_PRODUCTS:
Dell Powerprotect Data Manager Dm5500 Firmware
Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable...
AFFECTED_PRODUCTS:
Dell Powerprotect Data Manager Dm5500 Firmware
Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attacker may be able to use the exposed credentials to access th...
AFFECTED_PRODUCTS:
Dell Powerprotect Data Manager Dm5500 Firmware
Dell DM5500 5.14.0.0 contains an OS command injection vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exp...
AFFECTED_PRODUCTS:
Dell Powerprotect Data Manager Dm5500 Firmware
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+4)
TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6.
AFFECTED_PRODUCTS:
Cxong Tinydir
Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges.
AFFECTED_PRODUCTS:
Sei-Info Rakrak Document Plus,
Sei-Info Rakrak Document Plus
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
AFFECTED_PRODUCTS:
Htmlunit Htmlunit
In display drm, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363740; Issue ID: ALPS07363740.
AFFECTED_PRODUCTS:
Google Android,
Google Android
In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363632; Issue ID: ALPS07363689.
AFFECTED_PRODUCTS:
Google Android,
Google Android
In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363632; Issue ID: ALPS07363632.
AFFECTED_PRODUCTS:
Google Android,
Google Android
In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560793; Issue ID: ALPS07560793.
AFFECTED_PRODUCTS:
Google Android,
Google Android
In mmp, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342152; Issue ID: ALPS07342152.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Google Android
In display drm, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363456; Issue ID: ALPS07363456.
AFFECTED_PRODUCTS:
Google Android,
Google Android