MEDIUM Severity CVEs

Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject maliciou

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() end

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does n

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows f

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless clie

A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restriction

A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs.

A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to i

A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can ge

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthentica

Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A h

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both acce

2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3

In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs

In the Linux kernel, the following vulnerability has been resolved: platform/x86: classmate-laptop: Add missing NULL po

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: block cache/dio write during f2fs_ena

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.jso

A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL)

The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could per

A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on

A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper valida

Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unau

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled searc

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unn

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privileg

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unn

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unn

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,

The Seraphinite Accelerator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `te

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress

A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker

The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter

SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses

SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, le

SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the e

The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_ga

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases. See the  follow

A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corp

The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capa

The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the

A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporatio

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block.  The Concre

In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configu