CVE Vulnerability Catalog

The Chilexpress woo official plugin versions <= 1.2.9 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The GrandSlambert Login Configurator plugin versions <= 2.1 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The BBS e-Popup plugin versions up to 2.4.5 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

Teplitsa of social technologies Leyka plugin versions <= 3.30.1 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The WP-Hijri plugin versions up to 1.5.1 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The WooCommerce Returns and Warranty Requests plugin versions <= 2.1.6 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 2.10.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A use-after-free flaw was found in the memory management subsystem in the Linux Kernel, located in mm/mempolicy.c. This issue is caused by a race between mbind() and VMA-locked page fault, which may allow a local attacker to crash the system or lead to a kernel information leak.

CVE-2023-4296 allows an attacker to inject arbitrary code into the browser on the target device if they can trick an admin user of PTC Codebeamer into clicking on a malicious link.

Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker to cause a denial of service via the chucnked_vectors.rs component.

Use after free in MediaStream in Google Chrome prior to version 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern.

A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

AOMedia versions 3.0.0 to 3.5.0 contain a bug that allows invalid memory read access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.

Nokia Service Router Operating System (SR OS) version 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.

FRRouting FRR versions 7.5.1 through 9.0 and Pica8 PICOS version 4.3.3.2 are vulnerable to a denial of service attack. A remote attacker can exploit a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

Dell PowerScale OneFS w wersjach 8.2.2.x-9.5.0.x zawiera lukę w zarządzaniu uprawnieniami. Zdalny atakujący z niskimi uprawnieniami może wykorzystać tę lukę do eskalacji uprawnień.