‼ CVE-2022-0575 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25018 ‼
📖 Read
via "National Vulnerability Database".
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44879 ‼
📖 Read
via "National Vulnerability Database".
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0300 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45444 ‼
📖 Read
via "National Vulnerability Database".
In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0291 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0200 ‼
📖 Read
via "National Vulnerability Database".
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22765 ‼
📖 Read
via "National Vulnerability Database".
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). BD Viper LT system versions 4.0 and later utilize Microsoft Windows 10 and have additional Operating System hardening configurations which increase the attack complexity required to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0176 ‼
📖 Read
via "National Vulnerability Database".
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0302 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0311 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0310 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0208 ‼
📖 Read
via "National Vulnerability Database".
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25109 ‼
📖 Read
via "National Vulnerability Database".
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24977 ‼
📖 Read
via "National Vulnerability Database".
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0304 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24446 ‼
📖 Read
via "National Vulnerability Database".
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0206 ‼
📖 Read
via "National Vulnerability Database".
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0570 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25115 ‼
📖 Read
via "National Vulnerability Database".
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0571 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.📖 Read
via "National Vulnerability Database".