| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-22429 | Hig | 0.51 | 7.8 | 0.00 | Apr 11, 2023 | Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary. | ||
| CVE-2023-22282 | Hig | 0.47 | 7.3 | 0.00 | Apr 11, 2023 | WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows… | ||
| CVE-2023-26122 | Hig | 0.57 | 8.8 | 0.02 | Apr 11, 2023 | All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable… | ||
| CVE-2023-26121 | Hig | 0.49 | 7.5 | 0.01 | Apr 11, 2023 | All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content. | ||
| CVE-2023-29186 | Hig | 0.58 | 8.7 | 0.23 | Apr 11, 2023 | In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then… | ||
| CVE-2023-27191 | Hig | 0.49 | 7.5 | 0.01 | Apr 11, 2023 | An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files. | ||
| CVE-2022-38604 | Hig | 0.47 | 7.3 | 0.01 | Apr 11, 2023 | Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability. | ||
| CVE-2023-1668 | Hig | 0.53 | 8.2 | 0.01 | Apr 10, 2023 | A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols… | ||
| CVE-2023-29005 | Hig | 0.42 | 7.5 | 0.01 | Apr 10, 2023 | Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`. | ||
| CVE-2023-26466 | Hig | 0.51 | 7.8 | 0.00 | Apr 10, 2023 | A user with non-Admin access can change a configuration file on the client to modify the Server URL. | ||
| CVE-2023-26495 | Hig | 0.51 | 7.8 | 0.00 | Apr 10, 2023 | An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code. | ||
| CVE-2023-26067 | Hig | 0.56 | 8.1 | 0.38 | Apr 10, 2023 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). | ||
| CVE-2023-28206 | Hig | 0.70 | 8.6 | 0.23 | KEV | Apr 10, 2023 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with… | |
| CVE-2023-28205 | Hig | 0.71 | 8.8 | 0.27 | KEV | Apr 10, 2023 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is… | |
| CVE-2022-46716 | Hig | 0.49 | 7.5 | 0.00 | Apr 10, 2023 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings | ||
| CVE-2022-42858 | Hig | 0.51 | 7.8 | 0.00 | Apr 10, 2023 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges | ||
| CVE-2023-26986 | Hig | 0.51 | 7.8 | 0.01 | Apr 10, 2023 | An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox. | ||
| CVE-2023-26919 | Hig | 0.47 | 7.2 | 0.01 | Apr 10, 2023 | delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process. | ||
| CVE-2023-1381 | Hig | 0.57 | 8.8 | 0.02 | Apr 10, 2023 | The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to… | ||
| CVE-2023-1425 | Hig | 0.47 | 7.2 | 0.01 | Apr 10, 2023 | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such… | ||
| CVE-2023-1406 | Hig | 0.57 | 8.8 | 0.02 | Apr 10, 2023 | The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. | ||
| CVE-2023-26860 | Hig | 0.57 | 8.8 | 0.01 | Apr 10, 2023 | SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component. | ||
| CVE-2020-36077 | Hig | 0.57 | 8.8 | 0.01 | Apr 10, 2023 | SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer parameter of the orderadd.php file | ||
| CVE-2023-26774 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2023 | An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint. | ||
| CVE-2021-45985 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2023 | In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. | ||
| CVE-2023-27730 | Hig | 0.49 | 7.5 | 0.01 | Apr 9, 2023 | Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c. | ||
| CVE-2023-27729 | Hig | 0.49 | 7.5 | 0.01 | Apr 9, 2023 | Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c. | ||
| CVE-2023-27728 | Hig | 0.49 | 7.5 | 0.01 | Apr 9, 2023 | Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c. | ||
| CVE-2023-27727 | Hig | 0.49 | 7.5 | 0.01 | Apr 9, 2023 | Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h. | ||
| CVE-2023-1964 | Hig | 0.48 | 7.3 | 0.01 | Apr 9, 2023 | A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file recovery.php of the component Password Reset. The manipulation of the argument uname/mobile leads to sql injection. It is possible… | ||
| CVE-2023-1962 | Hig | 0.48 | 7.3 | 0.01 | Apr 9, 2023 | A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php of the component POST Parameter Handler. The manipulation of the argument username… | ||
| CVE-2023-1955 | Hig | 0.48 | 7.3 | 0.01 | Apr 8, 2023 | A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is an unknown function of the file login.php of the component User Registration. The manipulation of the argument email leads to sql injection. It is possible… | ||
| CVE-2023-27180 | Hig | 0.49 | 7.5 | 0.01 | Apr 7, 2023 | GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /_admin/backup.php. | ||
| CVE-2023-23761 | Hig | 0.50 | 7.7 | 0.00 | Apr 7, 2023 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This… | ||
| CVE-2023-1941 | Hig | 0.48 | 7.3 | 0.01 | Apr 7, 2023 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The… | ||
| CVE-2023-29388 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions. | ||
| CVE-2023-29172 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions. | ||
| CVE-2023-29171 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions. | ||
| CVE-2023-28792 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions. | ||
| CVE-2023-28789 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. | ||
| CVE-2023-28781 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. | ||
| CVE-2023-28710 | Hig | 0.42 | 7.5 | 0.02 | Apr 7, 2023 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1. | ||
| CVE-2023-28707 | Hig | 0.42 | 7.5 | 0.02 | Apr 7, 2023 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2. | ||
| CVE-2023-27876 | Hig | 0.46 | 7.1 | 0.01 | Apr 7, 2023 | IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249975. | ||
| CVE-2023-25713 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions. | ||
| CVE-2023-29236 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions. | ||
| CVE-2023-28993 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions. | ||
| CVE-2023-25041 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions. | ||
| CVE-2023-25020 | Hig | 0.46 | 7.1 | 0.00 | Apr 7, 2023 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions. | ||
| CVE-2023-28051 | Hig | 0.51 | 7.8 | 0.00 | Apr 7, 2023 | Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attacker could potentially exploit this vulnerability to elevate privileges on the system. |
- risk 0.51cvss 7.8epss 0.00
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary.
- risk 0.47cvss 7.3epss 0.00
WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows…
- risk 0.57cvss 8.8epss 0.02
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable…
- risk 0.49cvss 7.5epss 0.01
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
- risk 0.58cvss 8.7epss 0.23
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then…
- risk 0.49cvss 7.5epss 0.01
An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.
- risk 0.47cvss 7.3epss 0.01
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
- risk 0.53cvss 8.2epss 0.01
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols…
- risk 0.42cvss 7.5epss 0.01
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
- risk 0.51cvss 7.8epss 0.00
A user with non-Admin access can change a configuration file on the client to modify the Server URL.
- risk 0.51cvss 7.8epss 0.00
An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.
- risk 0.56cvss 8.1epss 0.38
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
- risk 0.70cvss 8.6epss 0.23
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with…
- risk 0.71cvss 8.8epss 0.27
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is…
- risk 0.49cvss 7.5epss 0.00
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings
- risk 0.51cvss 7.8epss 0.00
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges
- risk 0.51cvss 7.8epss 0.01
An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox.
- risk 0.47cvss 7.2epss 0.01
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
- risk 0.57cvss 8.8epss 0.02
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to…
- risk 0.47cvss 7.2epss 0.01
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such…
- risk 0.57cvss 8.8epss 0.02
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component.
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer parameter of the orderadd.php file
- risk 0.49cvss 7.5epss 0.01
An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint.
- risk 0.49cvss 7.5epss 0.01
In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
- risk 0.49cvss 7.5epss 0.01
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.
- risk 0.49cvss 7.5epss 0.01
Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.
- risk 0.49cvss 7.5epss 0.01
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.
- risk 0.49cvss 7.5epss 0.01
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.
- risk 0.48cvss 7.3epss 0.01
A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file recovery.php of the component Password Reset. The manipulation of the argument uname/mobile leads to sql injection. It is possible…
- risk 0.48cvss 7.3epss 0.01
A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php of the component POST Parameter Handler. The manipulation of the argument username…
- risk 0.48cvss 7.3epss 0.01
A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is an unknown function of the file login.php of the component User Registration. The manipulation of the argument email leads to sql injection. It is possible…
- risk 0.49cvss 7.5epss 0.01
GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /_admin/backup.php.
- risk 0.50cvss 7.7epss 0.00
An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's URL. This…
- risk 0.48cvss 7.3epss 0.01
A vulnerability, which was classified as critical, has been found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The…
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
- risk 0.42cvss 7.5epss 0.02
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1.
- risk 0.42cvss 7.5epss 0.02
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
- risk 0.46cvss 7.1epss 0.01
IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249975.
- risk 0.46cvss 7.1epss 0.00
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
- risk 0.51cvss 7.8epss 0.00
Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attacker could potentially exploit this vulnerability to elevate privileges on the system.