| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session. |
| The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed. |
| Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. |
| Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. |
| Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks. |
| Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service. |
