CVE Brief Security Intelligence

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5

VMware vCenter contains an SMTP header injection vulnerability

The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1

Account Takeover in Corezoid 6

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability

VMware NSX contains a weak password recovery mechanism vulnerability

Description: VMware NSX contains a username enumeration vulnerability

Dell Repository Manager (DRM), versions 3

A weakness has been identified in iHongRen pptp-vpn 1

Local privilege escalation due to insecure XPC service configuration

A flaw has been found in Tenda AC18 15

In Progress Chef Automate, versions earlier than 4

IBM InfoSphere 11

Local privilege escalation due to DLL hijacking vulnerability

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action

Improper restriction of XML external entity reference issue exists in DataSpider Servista 4

A reflected cross-site scripting (XSS) vulnerability in tawk

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user

There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in NI Circuit Design Suite

There is a memory corruption vulnerability due to an out of bounds read in DefaultFontOptions() when using SymbolEditor in NI Circuit Design Suite

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7

FreshRSS is a free, self-hostable RSS aggregator

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3)

This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static

Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write

A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486

A vulnerability was identified in Bjskzy Zhiyou ERP up to 11

A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field