| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1. |
| Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. |
| Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern. |
| Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally. |
| The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control. |
| Use after free in WebDAV allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. |
| Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. |
| Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
