vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity. Public exploit code available.
Information Disclosure
Vzctl
NVD
CVSS 2.0
3.6
EPSS
0.1%
Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
XSS
WordPress
PHP
Gallery Photo Albums Portfolio
NVD
CVSS 2.0
3.5
EPSS
0.1%