Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-0471 | 1 Google | 1 Chrome | 2023-02-06 | N/A | 8.8 HIGH |
| Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2023-0472 | 1 Google | 1 Chrome | 2023-02-06 | N/A | 8.8 HIGH |
| Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2023-0473 | 1 Google | 1 Chrome | 2023-02-06 | N/A | 8.8 HIGH |
| Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2019-13578 | 1 Givewp | 1 Givewp | 2023-02-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php. | |||||
| CVE-2023-0474 | 1 Google | 1 Chrome | 2023-02-06 | N/A | 8.8 HIGH |
| Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium) | |||||
| CVE-2021-24315 | 1 Givewp | 1 Givewp | 2023-02-06 | 3.5 LOW | 4.8 MEDIUM |
| The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. | |||||
| CVE-2021-24213 | 1 Givewp | 1 Givewp | 2023-02-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. | |||||
| CVE-2020-20627 | 1 Givewp | 1 Givewp | 2023-02-06 | 5.0 MEDIUM | 5.3 MEDIUM |
| The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. | |||||
| CVE-2019-20360 | 1 Givewp | 1 Givewp | 2023-02-06 | 5.0 MEDIUM | 7.5 HIGH |
| A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data. | |||||
| CVE-2019-15317 | 1 Givewp | 1 Givewp | 2023-02-06 | 3.5 LOW | 5.4 MEDIUM |
| The give plugin before 2.4.7 for WordPress has XSS via a donor name. | |||||
| CVE-2019-9909 | 1 Givewp | 1 Givewp | 2023-02-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. | |||||
| CVE-2021-40961 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-02-06 | 6.5 MEDIUM | 8.8 HIGH |
| CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '. | |||||
| CVE-2023-0512 | 1 Vim | 1 Vim | 2023-02-06 | N/A | 7.8 HIGH |
| Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. | |||||
| CVE-2022-23334 | 1 Ip-label | 1 Newtest | 2023-02-06 | N/A | 9.8 CRITICAL |
| The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE. | |||||
| CVE-2023-0581 | 1 Lcweb | 1 Privatecontent | 2023-02-06 | N/A | 5.3 MEDIUM |
| The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack. | |||||
| CVE-2022-4306 | 1 Panda Pods Repeater Field Project | 1 Panda Pods Repeater Field | 2023-02-06 | N/A | 5.4 MEDIUM |
| The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission. | |||||
| CVE-2019-25053 | 1 Sage | 1 Sage Frp 1000 | 2023-02-06 | N/A | 7.5 HIGH |
| A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL. | |||||
| CVE-2022-4395 | 1 Wpswings | 1 Membership For Woocommerce | 2023-02-06 | N/A | 9.8 CRITICAL |
| The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE. | |||||
| CVE-2023-22324 | 1 Contec | 1 Conprosys Hmi System | 2023-02-06 | N/A | 6.5 MEDIUM |
| SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command. As a result, information stored in the database may be obtained. | |||||
| CVE-2023-22322 | 1 Omron | 1 Cx-motion Pro | 2023-02-06 | N/A | 5.5 MEDIUM |
| Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed. | |||||