2022

Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addre

Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit

Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive infor

Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which c

The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 all

The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before insertin

The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary f

The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which cou

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information a

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the

The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, makin

The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in

The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege

The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that ca

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami Wor

The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, w

The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some o

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing an

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings,

The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PH

The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow hi

The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing a

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow

The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check author

The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logge

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allo

The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby pa

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_re

The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting th

The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, w

The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile

The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing h

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way t

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an atta

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password t

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify whic

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signa

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/

A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated

Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system c

Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.