CVE Vulnerability Catalog

Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.

An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices related to an EMFI attack on ECO3, allowing an attacker to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status.

The Faboba Falang plugin for WordPress versions up to 1.3.39 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.

The WooCommerce Shipping Multiple Addresses plugin versions up to 3.8.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The WooCommerce AutomateWoo plugin versions up to 5.7.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

CSRF vulnerability in WooCommerce Order Barcodes plugin versions <= 1.6.4 allows attackers to perform unauthorized actions on behalf of users.

The Etoile Web Design Front End Users plugin versions <= 3.2.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Membership plugin for WordPress before version 3.2.3 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as administrators.

The Autochat Automatic Conversation plugin for WordPress versions up to 1.1.7 does not sanitize and escape user input before outputting it back on the page, leading to a cross-site scripting attack.

CSRF vulnerability in WooCommerce Brands plugin versions <= 1.6.49 allows attackers to perform unauthorized actions on behalf of users.

The myCred plugin versions up to 2.5 contain a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.

The Zip Recipes plugin versions <= 8.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited to perform unauthorized actions on behalf of the user.

The WP PDF Generator plugin by wpexperts.Io versions up to 1.2.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

Reactive web applications using Spring HATEOAS to produce hypermedia-based responses may be exposed to malicious forwarded headers if not behind a trusted proxy or lacking mechanisms to handle such headers.

CVE-2023-3700 vulnerability involves authorization bypass through a user-controlled key in the GitHub repository alextselegidis/easyappointments prior to version 1.5.0.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the 'category' argument in the add-product.php file leads to SQL injection, allowing for remote attacks.

IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.

A critical vulnerability has been found in the House Rental and Property Listing application version 1.0, affecting unknown processing of the /index.php file. Manipulation of the keywords/location argument leads to SQL injection.

IBM InfoSphere Information Server version 11.7 could allow a remote attacker to obtain system information using a specially crafted query, which could aid in further attacks against the system.