Vulnerabilidades CVE

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

The ultimate-member plugin before 2.0.4 for WordPress has XSS.

The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

The ultimate-member plugin before 2.0.54 for WordPress has XSS.

The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easi...

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists.

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.

An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.

An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action.

Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.ADA.StorageAuditService (which writes to th...

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activa...

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.

On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a part...

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted...

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a cra...

In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash.

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop gen...

The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help.

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. I...

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.

NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system service where user data could be overridden, which may lead to code execution, den...

The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.

The contact-form-plugin plugin before 3.52 for WordPress has XSS.

The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.

The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.

The contact-form-plugin plugin before 3.96 for WordPress has XSS.

The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.

The events-manager plugin before 5.6 for WordPress has XSS.

The events-manager plugin before 5.6 for WordPress has code injection.