Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-31577 | 1 Mediatek | 4 En7528, En7528 Firmware, En7580 and 1 more | 2023-02-15 | N/A | 9.8 CRITICAL |
| In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241. | |||||
| CVE-2023-0260 | 1 Ljapps | 1 Wp Review Slider | 2023-02-15 | N/A | 8.8 HIGH |
| The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | |||||
| CVE-2023-0255 | 1 Shortpixel | 1 Enable Media Replace | 2023-02-15 | N/A | 8.8 HIGH |
| The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. | |||||
| CVE-2023-0220 | 1 Pinpoint | 1 Pinpoint Booking System | 2023-02-15 | N/A | 8.8 HIGH |
| The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks. | |||||
| CVE-2023-0159 | 1 Wprealize | 1 Extensive Vc Addons For Wpbakery Page Builder | 2023-02-15 | N/A | 7.5 HIGH |
| The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. | |||||
| CVE-2021-31576 | 1 Mediatek | 4 En7528, En7528 Firmware, En7580 and 1 more | 2023-02-15 | N/A | 7.5 HIGH |
| In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241. | |||||
| CVE-2023-0405 | 1 Gptaipower | 1 Gpt Ai Power | 2023-02-15 | N/A | 4.3 MEDIUM |
| The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts. | |||||
| CVE-2023-0379 | 1 Rebelcode | 1 Spotlight Social Feeds | 2023-02-15 | N/A | 5.4 MEDIUM |
| The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-0270 | 1 Yamaps Project | 1 Yamaps | 2023-02-15 | N/A | 5.4 MEDIUM |
| The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0177 | 1 Wpdevart | 1 Social Like Box And Page | 2023-02-15 | N/A | 5.4 MEDIUM |
| The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-0814 | 1 Cozmoslabs | 1 Profile Builder | 2023-02-15 | N/A | 6.5 MEDIUM |
| The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited. | |||||
| CVE-2023-0262 | 1 Ljapps | 1 Wp Airbnb Review Slider | 2023-02-15 | N/A | 8.8 HIGH |
| The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | |||||
| CVE-2023-0261 | 1 Ljapps | 1 Wp Tripadvisor Review Slider | 2023-02-15 | N/A | 8.8 HIGH |
| The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | |||||
| CVE-2023-0259 | 1 Ljapps | 1 Wp Google Review Slider | 2023-02-15 | N/A | 8.8 HIGH |
| The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | |||||
| CVE-2023-23941 | 1 Shopware | 1 Swagpaypal | 2023-02-15 | N/A | 7.5 HIGH |
| SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21. | |||||
| CVE-2023-23933 | 1 Amazon | 1 Opensearch | 2023-02-15 | N/A | 4.3 MEDIUM |
| OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data (e.g. averages, sums) of fields that are otherwise restricted to them. This issue only affects authenticated users who were previously granted read access to the indexes containing the restricted fields. This issue has been patched in versions 1.3.8 and 2.6.0. There are no known workarounds for this issue. | |||||
| CVE-2023-20854 | 2 Microsoft, Vmware | 2 Windows, Workstation | 2023-02-15 | N/A | 8.4 HIGH |
| VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed. | |||||
| CVE-2022-40136 | 1 Lenovo | 291 Ideacentre 3-07ada05, Ideacentre 3-07ada05 Firmware, Ideacentre 3-07imb05 and 288 more | 2023-02-15 | N/A | 4.4 MEDIUM |
| An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. | |||||
| CVE-2021-31575 | 1 Mediatek | 4 En7528, En7528 Firmware, En7580 and 1 more | 2023-02-15 | N/A | 9.8 CRITICAL |
| In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234. | |||||
| CVE-2022-4489 | 1 Pluginus | 1 Husky - Products Filter Professional For Woocommerce | 2023-02-15 | N/A | 7.2 HIGH |
| The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||