Total
2747 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-38698 | 1 Hashicorp | 1 Consul | 2022-09-14 | 4.0 MEDIUM | 6.5 MEDIUM |
| HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. | |||||
| CVE-2022-39119 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2022-09-14 | N/A | 7.8 HIGH |
| In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed | |||||
| CVE-2022-31167 | 1 Xwiki | 1 Xwiki | 2022-09-14 | N/A | 6.5 MEDIUM |
| XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds. | |||||
| CVE-2020-13512 | 1 Nzxt | 1 Cam | 2022-09-12 | 7.2 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. Using the IRP 0x9c40a0d8 gives a low privilege user direct access to the OUT instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2020-13513 | 1 Nzxt | 1 Cam | 2022-09-12 | 7.2 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. Using the IRP 0x9c40a0dc gives a low privilege user direct access to the OUT instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2020-13514 | 1 Nzxt | 1 Cam | 2022-09-12 | 7.2 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. Using the IRP 0x9c40a0e0 gives a low privilege user direct access to the OUT instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2020-13519 | 1 Nzxt | 1 Cam | 2022-09-12 | 7.2 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2020-13515 | 1 Nzxt | 1 Cam | 2022-09-12 | 7.2 HIGH | 8.8 HIGH |
| A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause an adversary to obtain elevated privileges. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2022-38370 | 1 Apache | 1 Iotdb | 2022-09-09 | N/A | 7.5 HIGH |
| Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue. | |||||
| CVE-2022-2657 | 1 Wc-marketplace | 1 Multivendor Marketplace Solution For Woocommerce - Wc Marketplace | 2022-09-08 | N/A | 4.3 MEDIUM |
| The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF | |||||
| CVE-2022-38367 | 1 Netic | 1 User Export For Jira | 2022-09-08 | N/A | 5.3 MEDIUM |
| The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint. | |||||
| CVE-2022-2376 | 1 Wpwax | 1 Directorist | 2022-09-08 | N/A | 5.3 MEDIUM |
| The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users | |||||
| CVE-2022-2543 | 1 Visualportfolio | 1 Visual Portfolio\, Photo Gallery \& Post Grid | 2022-09-08 | N/A | 6.1 MEDIUM |
| The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts | |||||
| CVE-2022-2373 | 1 Nsqua | 1 Simply Schedule Appointments | 2022-09-01 | N/A | 5.3 MEDIUM |
| The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address | |||||
| CVE-2021-24164 | 1 Ninjaforms | 1 Ninja Forms | 2022-08-30 | 4.0 MEDIUM | 4.3 MEDIUM |
| In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection. | |||||
| CVE-2021-24146 | 1 Webnus | 1 Modern Events Calendar Lite | 2022-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. | |||||
| CVE-2021-24839 | 1 Supportcandy | 1 Supportcandy | 2022-08-30 | 5.0 MEDIUM | 7.5 HIGH |
| The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well. | |||||
| CVE-2021-24851 | 1 Insert Pages Project | 1 Insert Pages | 2022-08-30 | 4.0 MEDIUM | 4.3 MEDIUM |
| The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue. | |||||
| CVE-2021-24906 | 1 Wp-experts | 1 Protect Wp Admin | 2022-08-29 | 5.0 MEDIUM | 7.5 HIGH |
| The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request | |||||
| CVE-2022-32769 | 1 Wwbn | 1 Avideo | 2022-08-24 | N/A | 5.0 MEDIUM |
| Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Playlists plugin, allowing an attacker to bypass authentication by guessing a sequential ID, allowing them to take over the another user's playlists. | |||||