Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-6412 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 7.5 HIGH |
| A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. | |||||
| CVE-2023-6411 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 7.5 HIGH |
| A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in the update parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. | |||||
| CVE-2023-6410 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 7.5 HIGH |
| A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. | |||||
| CVE-2023-30585 | 1 Nodejs | 1 Node.js | 2023-12-02 | N/A | 7.5 HIGH |
| A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry. The issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations. The severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or "non-privileged") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations. It is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue. | |||||
| CVE-2023-6432 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6431 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/categories_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6430 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/transactions_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6429 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6428 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6427 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6426 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6425 | 1 Bigprof | 1 Online Clinic Management System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/medical_records_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6424 | 1 Bigprof | 1 Online Clinic Management System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/disease_symptoms_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6423 | 1 Bigprof | 1 Online Clinic Management System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/events_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6422 | 1 Bigprof | 1 Online Clinic Management System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/patients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6420 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 6.1 MEDIUM |
| A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user. | |||||
| CVE-2023-6419 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 6.1 MEDIUM |
| A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user. | |||||
| CVE-2023-6418 | 1 Aatifaneeq | 1 Voovi | 2023-12-02 | N/A | 7.5 HIGH |
| A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. | |||||
| CVE-2023-6435 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/batches_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6434 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/sections_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-6433 | 1 Bigprof | 1 Online Invoicing System | 2023-12-02 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/suppliers_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads. | |||||
| CVE-2023-5958 | 1 Wpexperts | 1 Post Smtp Mailer | 2023-12-02 | N/A | 6.1 MEDIUM |
| The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users. | |||||
| CVE-2023-5738 | 1 Webtoffee | 1 Backup And Migration | 2023-12-02 | N/A | 5.4 MEDIUM |
| The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks. | |||||
| CVE-2023-5620 | 1 Webpushr | 1 Web Push Notifications | 2023-12-02 | N/A | 5.4 MEDIUM |
| The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks. | |||||
| CVE-2023-5611 | 1 Seraphinitesolutions | 1 Seraphinite Accelerator | 2023-12-02 | N/A | 5.3 MEDIUM |
| The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them | |||||
| CVE-2023-5604 | 1 Asgaros | 1 Asgaros Forum | 2023-12-02 | N/A | 9.8 CRITICAL |
| The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution. | |||||
| CVE-2023-41998 | 1 Arcserve | 1 Udp | 2023-12-02 | N/A | 9.8 CRITICAL |
| Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files. | |||||
| CVE-2023-2707 | 1 Gappointments | 1 Gappointments | 2023-12-02 | N/A | 4.8 MEDIUM |
| The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-47831 | 1 Assortedchips | 1 Drawit | 2023-12-02 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions. | |||||
| CVE-2022-41717 | 2 Fedoraproject, Golang | 3 Fedora, Go, Http2 | 2023-12-02 | N/A | 5.3 MEDIUM |
| An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. | |||||
| CVE-2023-39971 | 1 Acymailing | 1 Acymailing | 2023-12-02 | N/A | 6.1 MEDIUM |
| Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3. | |||||
| CVE-2022-27914 | 1 Joomla | 1 Joomla\! | 2023-12-02 | N/A | 6.1 MEDIUM |
| An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media. | |||||
| CVE-2022-27913 | 1 Joomla | 1 Joomla\! | 2023-12-02 | N/A | 6.1 MEDIUM |
| An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components. | |||||
| CVE-2022-27912 | 1 Joomla | 1 Joomla\! | 2023-12-02 | N/A | 5.3 MEDIUM |
| An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests. | |||||
| CVE-2023-48106 | 1 Zlib-ng | 1 Minizip-ng | 2023-12-02 | N/A | 8.8 HIGH |
| Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file. | |||||
| CVE-2023-47755 | 1 Aazztech | 1 Woocommerce Product Carousel Slider | 2023-12-02 | N/A | 6.1 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3.5 versions. | |||||
| CVE-2023-5708 | 1 Wp Post Columns Project | 1 Wp Post Columns | 2023-12-02 | N/A | 5.4 MEDIUM |
| The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-5706 | 1 Vektor-inc | 1 Vk Blocks | 2023-12-02 | N/A | 5.4 MEDIUM |
| The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-48185 | 1 Terra-mater | 1 Terra-master | 2023-12-02 | N/A | 7.5 HIGH |
| Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request. | |||||
| CVE-2014-125096 | 1 Fancy Gallery Project | 1 Fancy Gallery | 2023-12-01 | N/A | 6.1 MEDIUM |
| A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability. | |||||
| CVE-2017-20156 | 1 Printer Project | 1 Printer | 2023-12-01 | N/A | 9.8 CRITICAL |
| A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139. | |||||
| CVE-2014-125095 | 1 Bestwebsoft | 1 Contact Form | 2023-12-01 | N/A | 6.1 MEDIUM |
| A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320. | |||||
| CVE-2017-20155 | 1 Sterc | 1 Google Analytics Dashboard For Modx | 2023-12-01 | N/A | 6.1 MEDIUM |
| A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal Search. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is 855d9560d3782c105568eedf9b22a769fbf29cc0. It is recommended to upgrade the affected component. The identifier VDB-217069 was assigned to this vulnerability. | |||||
| CVE-2014-125093 | 1 Getadmiral | 1 Ad Blocking Detector | 2023-12-01 | N/A | 7.5 HIGH |
| A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 1.2.2 is able to address this issue. The patch is identified as 3312b9cd79e5710d1e282fc9216a4e5ab31b3d94. It is recommended to upgrade the affected component. VDB-222610 is the identifier assigned to this vulnerability. | |||||
| CVE-2014-125081 | 1 Debutsav Project | 1 Debutsav | 2023-12-01 | N/A | 9.8 CRITICAL |
| A vulnerability, which was classified as critical, has been found in risheesh debutsav. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 7a8430df79277c613449262201cc792db894fc76. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218459. | |||||
| CVE-2014-125084 | 1 Gimmie Project | 1 Gimmie | 2023-12-01 | N/A | 9.8 CRITICAL |
| A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability. | |||||
| CVE-2023-32064 | 1 Oroinc | 1 Orocommerce | 2023-12-01 | N/A | 4.3 MEDIUM |
| OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1. | |||||
| CVE-2023-32065 | 1 Oroinc | 1 Orocommerce | 2023-12-01 | N/A | 5.8 MEDIUM |
| OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1. | |||||
| CVE-2023-48713 | 1 Knative | 1 Serving | 2023-12-01 | N/A | 5.3 MEDIUM |
| Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0. | |||||
| CVE-2023-32063 | 1 Oroinc | 1 Client Relationship Management | 2023-12-01 | N/A | 5.0 MEDIUM |
| OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1. | |||||