Archive
19 January 2022
Vulnerabilities first published on this day (UTC), newest first.
233 results · Feed
-
Unscored —
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF lo…
-
Unscored —
mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog ta…
-
Unscored —
mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CS…
-
Unscored —
A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list i…
-
High 8.1
Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton
Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
-
Medium 5.0
Privileged Escalation in Istio
Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this p…
-
Medium 6.8
Authorization Policy bypass in Istio
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade fro…
-
High 8.2
Execution with Unnecessary Privileges in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not p…
-
Medium 5.4
WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
-
Unscored —
PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" paramete…
-
Unscored —
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a s…
-
High 8.8
Lack of authentication mechanisms on the device
The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can ci…
-
Medium 5.7
Use of Hard-coded Cryptographic Key
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exp…
-
Unscored —CVE-2021-26247 Scanner template
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" …
-
Unscored —
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the …
-
Unscored —
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix f…
-
High 8.0
TIBCO EBX vulnerabilities
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a l…
-
High 7.4
Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
-
Unscored —
Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the …
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows a…
-
Unscored —
Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vuln…
-
Unscored —
Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.
-
Unscored —
jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021,…
-
High 7.8
Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users
A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.
-
Medium 4.8
IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A rem…
-
Unscored —
jQuery UI is a third-party library used by Drupal. The jQuery UI Datepicker module provides the jQuery UI Datepicker li…
-
Unscored —
The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious ap…
-
Unscored —
There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into …
-
Unscored —
An issue was discovered in Delta RM 1.2. It is possible for an unprivileged user to access the same information as an a…
-
Unscored —
jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the …
-
Unscored —
There is an integer overflow in the ION driver "/dev/ion" of Allwinner R818 SoC Android Q SDK V1.0 that could use the i…
-
Unscored —CVE-2021-46104 Scanner template
An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary f…
-
Unscored —
There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could c…
-
Medium 6.6
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…
-
Medium 4.8
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…
-
Medium 6.6
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…
-
Medium 5.4
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…
-
Medium 6.6
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…
-
Medium 5.4
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…