All CVEs — page 473 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows authenticated attackers with author-level access or higher to delete arbitrary files on the server by exploiting insufficient file path validation in the upload_image function.
The flaw allows remote attackers to gain unauthorized access to an authenticated management session by reusing a session identifier, posing a significant security risk.
The flaw occurs when Apache Qpid Broker-J converts messages from AMQP 1.0 to AMQP 0-10 format, failing to properly handle property-encoding exceptions. This allows authenticated message producers to send malformed properties that cause the broker to crash or become unresponsive during message delivery to AMQP 0-10 consumers, leading to denial of service.
The Knit Pay plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to administrator by tampering with the role field in Gravity Forms entries.
The Modula Image Gallery plugin fails to properly validate access to private galleries, allowing unauthenticated users to enumerate and access private gallery contents through metadata exposure in HTML headers. This vulnerability stems from a flawed input validation check that always returns false, bypassing necessary capability checks and post status validations.
The flaw allows remote code execution via the 'first_name' parameter, due to insufficient sanitization and exposure of the site-global proxy verification key.
The WP Maps plugin contains a local file inclusion vulnerability that allows authenticated users with subscriber-level access or higher to include and execute arbitrary PHP files on the server. This can lead to full code execution and data compromise.