CVE Vulnerability Catalog

The WP Affiliate Links plugin versions up to 0.1.1 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The EventPrime plugin versions up to 3.0.5 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to and including 2.287. This allows unauthenticated attackers to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities.

A vulnerability was found in the cpufreq subsystem in the Linux Kernel, specifically in drivers/cpufreq/qcom-cpufreq-hw.c. This flaw, during device unbind, leads to a double release problem resulting in denial of service.

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.

A vulnerability related to abnormal callbacks passed to APIs, which may lead to system restarts. Successful exploitation of this vulnerability may cause the system to restart.

There is a permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause features to perform abnormally.

There is a version update determination vulnerability in the user profile module. Successful exploitation of this vulnerability may lead to repeated HMS Core updates and service failures.

There is an inappropriate authorization vulnerability in the SettingsProvider module. Successful exploitation of this vulnerability may cause features to perform abnormally.

Vulnerability of unauthorized calling on HUAWEI phones and tablets. Successful exploitation of this vulnerability may affect availability.

The WP Backup Manager plugin versions up to 1.13.1 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The Google Map Shortcode plugin by Alain Gonzalez in versions up to 3.1.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

Podatność CVE-2022-46850 dotyczy wtyczki Easy Media Replace w wersjach do 0.1.3, która ma lukę w kontroli dostępu, umożliwiającą usunięcie dowolnych plików. Problem ten występuje w kontekście autoryzacji użytkowników.

Potential use-after-free in libaudio, fixed by disabling AAudio backend on Android below version 30. Affects only Firefox for Android before 110.1.0.

JeecgBoot up to version 3.5.1 was found to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at SystemApiController.

JeecgBoot up to version 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at SystemApiController.

KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPicker(), which can then be used to open an unprivileged command prompt.

KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt.

In Suricata before version 6.0.13, an adversary controlling an external source of rules may exploit a dataset filename to trigger directory traversal, leading to write access to the local filesystem. This issue is addressed in version 6.0.13 by requiring the use of allow-absolute-filenames and allow-write options in the datasets rules configuration section.

VirtualSquare picoTCP through version 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.