Archive
21 January 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 6.5
Denial of Service in graphql-go
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics…
-
Medium 6.3
Incorrect Authorization in wasmCloud
wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their…
-
Medium —
Denial of service in bingrep
Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).
-
Medium 6.9
Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker…
-
Medium 6.3
Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious u…
-
Medium 6.0
Insufficient Session Expiration in Pterodactyl API
### Impact A vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to …
-
Medium —
Invalid URL generation in bitlyshortener
### Impact Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately. ### Patches Upgrading `bitlyshortener` to 0.6.0 or newer will prevent the genera…
-
Medium 4.3
Moodle Improper Authentication
A session hijack risk was identified in the Shibboleth authentication plugin.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
-
Medium 4.3
Moodle Incorrect Authorization
Insufficient capability checks made it possible for teachers to download users outside of their courses.
-
Medium 6.5
Moodle type juggling vulnerability
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
-
Medium 5.4
Fresenius Kabi Agilia Connect Infusion System cross site scripting
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing int…
-
Medium 6.3
Fresenius Kabi Agilia Connect Infusion System hard coded credentials
Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession of the password may gain privileges on all installations of this software.
-
Medium 5.3
Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties
Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.
-
Medium 6.5
Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly sec…
-
Medium 6.5
Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ que…
-
Medium 5.3
Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exis…
-
Medium 5.9
Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitra…
-
Medium 4.9
Moodle Improper Encoding or Escaping of Output
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
-
Medium 5.9
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64…
-
Medium 5.3
Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
-
Medium 4.0
Rapid7 Insight Agent Improper Access Control
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_i…
-
Medium 6.7
ASUS VivoMini/Mini PC - improper input validation
ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting serv…
-
Medium 5.5
NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
-
Medium 5.5
Out-of-bounds Read in vim/vim
Out-of-bounds Read in vim/vim prior to 8.2.
-
Medium 6.6
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in vim/vim prior to 8.2.