| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network. |
| A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. |
| Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server.
Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result.
Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication. |
| Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network. |
| Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. |
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. |
| External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
| Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
| Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. |
| Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
| Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalization <= 1.10.1 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions. |
| Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
| Contributor SQL Injection in Event Tickets <= 5.29.5 versions. |
| Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions. |
| Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
| Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions. |
| Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
