Archive
21 January 2022
Vulnerabilities first published on this day (UTC), newest first.
83 results · Feed
-
Medium 5.4
Fresenius Kabi Agilia Connect Infusion System cross site scripting
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing int…
-
Medium 6.3
Fresenius Kabi Agilia Connect Infusion System hard coded credentials
Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession of the password may gain privileges on all installations of this software.
-
Medium 5.3
Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties
Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.
-
Medium 6.5
Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly sec…
-
Medium 6.5
Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ que…
-
Medium 5.3
Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exis…
-
Medium 5.9
Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitra…
-
High 7.3
Fresenius Kabi Agilia Connect Infusion System
Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or…
-
High 7.3
Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials
The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently.
-
High 7.5
Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption
Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system.
-
Medium 4.9
Moodle Improper Encoding or Escaping of Output
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
-
Unscored —
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4…
-
Unscored —
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONIC…
-
Unscored —
Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior…
-
Medium 5.9
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64…
-
Unscored —
Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.
-
Unscored —
A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure all…
-
Unscored —CVE-2021-44593 Public exploit
Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL inj…
-
Medium 5.3
Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
-
Medium 4.0
Rapid7 Insight Agent Improper Access Control
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_i…
-
High 7.3
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused …
-
High 7.3
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fiel…
-
High 7.1
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when pr…
-
High 7.1
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when pr…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the usern…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter.
-
Unscored —
An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.p…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Online Resort Management System 1.0 via the id parameterv in /o…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter…
-
Unscored —
The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-produ…
-
Unscored —
An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/aj…
-
Unscored —
When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtaine…
-
Unscored —
When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read v…
-
Unscored —
Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sendi…
-
Medium 6.7
ASUS VivoMini/Mini PC - improper input validation
ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting serv…
-
Medium 5.5
NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
-
Medium 5.5
Out-of-bounds Read in vim/vim
Out-of-bounds Read in vim/vim prior to 8.2.
-
Medium 6.6
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in vim/vim prior to 8.2.