Medium · CVSS 5.9
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from a mapped drive into a web email client. Loading from a local driver was correctly prevented. Versions prior to 11.9 correctly detected and blocked the attempted upload of sensitive data.
Published Feb 1, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.7
In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494107; Issue ID: ALPS07494107.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.7
In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494067; Issue ID: ALPS07494067.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 4.4
In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07550104; Issue ID: ALPS07550104.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 4.4
In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07571104; Issue ID: ALPS07571104.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.5
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220036.
Published Feb 2, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.4
In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363599; Issue ID: ALPS07363599.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.4
In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363469; Issue ID: ALPS07363469.
Published Feb 6, 2023 · Updated Mar 26, 2025
High · CVSS 8.4
VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.
Published Feb 3, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.4
In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588678; Issue ID: ALPS07588678.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.7
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629571; Issue ID: ALPS07629571.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.7
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628614; Issue ID: ALPS07628614.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 6.7
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628615; Issue ID: ALPS07628615.
Published Feb 6, 2023 · Updated Mar 26, 2025
Critical · CVSS 9.8
Raffle Draw System v1.0 was discovered to contain multiple SQL injection vulnerabilities at save_winner.php via the ticket_id and draw parameters.
Published Feb 6, 2023 · Updated Mar 26, 2025
Critical · CVSS 9.8
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at delete_ticket.php.
Published Feb 6, 2023 · Updated Mar 26, 2025
Critical · CVSS 9.8
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at save_ticket.php.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 26, 2025
Critical · CVSS 9.8
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.
Published Feb 6, 2023 · Updated Mar 26, 2025
Critical · CVSS 9.8
Raffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the page parameter in index.php.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 5.4
The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 4.4
In ccu, there is a possible out of bounds read due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07570864; Issue ID: ALPS07570864.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 5.4
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 26, 2025
Medium · CVSS 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.3
A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.
Published Feb 3, 2023 · Updated Mar 25, 2025
Medium · CVSS 6.5
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
Published Feb 3, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Published Feb 6, 2023 · Updated Mar 25, 2025
High · CVSS 7.5
EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.
Published Feb 3, 2023 · Updated Mar 25, 2025
High · CVSS 7.5
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
Published Feb 4, 2023 · Updated Mar 25, 2025
Critical · CVSS 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.
Published Feb 3, 2023 · Updated Mar 25, 2025
Critical · CVSS 9.9
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
Published Feb 4, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
High · CVSS 8.1
IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.
Published Feb 3, 2023 · Updated Mar 25, 2025
Medium · CVSS 6.1
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.
Published Feb 1, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.5
A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.
Published Feb 6, 2023 · Updated Mar 25, 2025
High · CVSS 7.5
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published Feb 1, 2023 · Updated Mar 25, 2025
High · CVSS 8.1
Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 6.1
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features.
Upgrade to Apache Sling App CMS >= 1.1.6
Published Feb 4, 2023 · Updated Mar 25, 2025
Medium · CVSS 6.4
In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07512839; Issue ID: ALPS07512839.
Published Feb 6, 2023 · Updated Mar 25, 2025
Critical · CVSS 9.1
Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity.
Published Feb 18, 2024 · Updated Mar 25, 2025
Critical · CVSS 9.8
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
Published Feb 6, 2023 · Updated Mar 25, 2025
High · CVSS 7.5
Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
Medium · CVSS 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published Feb 6, 2023 · Updated Mar 25, 2025
