Export limit exceeded: 373716 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373716 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1601 | 1 Alexanderschneider | 1 User Access Manager | 2024-11-21 | 5.3 Medium |
| The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations. | ||||
| CVE-2022-1600 | 1 Yop-poll | 1 Yop Poll | 2024-11-21 | 5.3 Medium |
| The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations. | ||||
| CVE-2022-1599 | 1 Admin Management Xtended Project | 1 Admin Management Xtended | 2024-11-21 | 6.5 Medium |
| The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more. | ||||
| CVE-2022-1598 | 1 2code | 1 Wpqa Builder | 2024-11-21 | 5.3 Medium |
| The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. | ||||
| CVE-2022-1597 | 1 2code | 1 Wpqa Builder | 2024-11-21 | 6.1 Medium |
| The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks | ||||
| CVE-2022-1596 | 1 Abb | 6 Rex640 Pcl1, Rex640 Pcl1 Firmware, Rex640 Pcl2 and 3 more | 2024-11-21 | 6.5 Medium |
| Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node. | ||||
| CVE-2022-1595 | 1 Hc Custom Wp-admin Url Project | 1 Hc Custom Wp-admin Url | 2024-11-21 | 5.3 Medium |
| The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request | ||||
| CVE-2022-1594 | 1 Hc Custom Wp-admin Url Project | 1 Hc Custom Wp-admin Url | 2024-11-21 | 4.3 Medium |
| The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL | ||||
| CVE-2022-1593 | 1 Site Offline Or Coming Soon Project | 1 Site Offline Or Coming Soon | 2024-11-21 | 6.1 Medium |
| The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack | ||||
| CVE-2022-1592 | 1 Clinical-genomics | 1 Scout | 2024-11-21 | 8.2 High |
| Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss... | ||||
| CVE-2022-1591 | 1 Wordpress Ping Optimizer Project | 1 Wordpress Ping Optimizer | 2024-11-21 | 4.3 Medium |
| The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1587 | 4 Fedoraproject, Netapp, Pcre and 1 more | 17 Fedora, Active Iq Unified Manager, H300s and 14 more | 2024-11-21 | 9.1 Critical |
| An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. | ||||
| CVE-2022-1585 | 1 Project-source-code-download Project | 1 Project-source-code-download | 2024-11-21 | 7.5 High |
| The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php. | ||||
| CVE-2022-1584 | 1 Microweber | 1 Microweber | 2024-11-21 | 6.1 Medium |
| Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim | ||||
| CVE-2022-1583 | 1 Webfactoryltd | 1 External Links In New Window \/ New Tab | 2024-11-21 | 6.5 Medium |
| The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. | ||||
| CVE-2022-1582 | 1 Webfactoryltd | 1 External Links In New Window \/ New Tab | 2024-11-21 | 6.1 Medium |
| The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible. | ||||
| CVE-2022-1580 | 1 Freehtmldesigns | 1 Site Offline | 2024-11-21 | 4.3 Medium |
| The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature. | ||||
| CVE-2022-1577 | 1 Deliciousbrains | 1 Database Backup | 2024-11-21 | 5.4 Medium |
| The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule | ||||
| CVE-2022-1576 | 1 Themeisle | 1 Wp Maintenance Mode \& Coming Soon | 2024-11-21 | 6.5 Medium |
| The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack | ||||
| CVE-2022-1575 | 1 Diagrams | 1 Drawio | 2024-11-21 | 9.6 Critical |
| Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app. | ||||