Archive
13 April 2021
Vulnerabilities first published on this day (UTC), newest first.
47 results · Clear filters · Feed
-
Medium —
Exposure of .env if project root is configured as web root in shopware/production
### Impact The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root. ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Update…
-
Medium —
Potential API key leak
If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel. This is patched in v1.2.4
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclat…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description p…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID pa…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID p…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…