‼ CVE-2022-23837 ‼
📖 Read
via "National Vulnerability Database".
In api.rb in Sidekiq before 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23366 ‼
📖 Read
via "National Vulnerability Database".
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21708 ‼
📖 Read
via "National Vulnerability Database".
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. The issue has been patched in version `v1.3.0`. The only known workaround for this issue is to disable the `graphql.MaxDepth` option from your schema which is not recommended.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23808 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23807 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4172 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4103 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 1.0.34.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23850 ‼
📖 Read
via "National Vulnerability Database".
xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46024 ‼
📖 Read
via "National Vulnerability Database".
Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45380 ‼
📖 Read
via "National Vulnerability Database".
AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23852 ‼
📖 Read
via "National Vulnerability Database".
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23858 ‼
📖 Read
via "National Vulnerability Database".
In StarWind Command Center before V2 build 6021, an authenticated read-only user can elevate privileges to administrator through the REST API.📖 Read
via "National Vulnerability Database".
❌ Unusual ‘Donald Trump’ Packer Malware Delivers RATs, Infostealers ❌
📖 Read
via "Threat Post".
The ‘DTPacker’ downloader used fake Liverpool Football Club sites as lures for several weeks, a report finds.📖 Read
via "Threat Post".
Threat Post
Unusual ‘Donald Trump’ Packer Malware Delivers RATs, Infostealers
The ‘DTPacker’ downloader used fake Liverpool Football Club sites as lures for several weeks, a report finds.
‼ CVE-2021-25035 ‼
📖 Read
via "National Vulnerability Database".
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25045 ‼
📖 Read
via "National Vulnerability Database".
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24858 ‼
📖 Read
via "National Vulnerability Database".
The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25083 ‼
📖 Read
via "National Vulnerability Database".
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25076 ‼
📖 Read
via "National Vulnerability Database".
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24694 ‼
📖 Read
via "National Vulnerability Database".
The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24696 ‼
📖 Read
via "National Vulnerability Database".
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25079 ‼
📖 Read
via "National Vulnerability Database".
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page📖 Read
via "National Vulnerability Database".