Archive
24 January 2022
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
Unscored —
Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation o…
-
High 8.2
Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local a…
-
Medium 6.0
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS…
-
Medium 4.3
Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthentic…
-
Medium 4.3
Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Unscored —
An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript …
-
Unscored —
An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to re…
-
Unscored —
An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, …
-
Unscored —
An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable t…
-
Unscored —
An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it i…
-
Medium 5.4
Cross-site Scripting Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API…
-
High 7.1
Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or informat…
-
Medium 4.7
Cross-site Scripting in ShortDescription extension
ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the pag…
-
Unscored —
A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root …
-
Unscored —
An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter …
-
Unscored —
SQL injection vulnerability in Login.php in Sourcecodester Online Payment Hub v1 by oretnom23, allows attackers to exec…
-
Unscored —
SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to exec…
-
Unscored —
Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attacker…
-
Low 3.3
This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer. An…
-
Unscored —
TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles,…
-
Unscored —
Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, a…
-
Unscored —
Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers …
-
Unscored —
SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to…
-
Unscored —
SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL…
-
Unscored —
Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute…
-
High 8.4
Blind SQL injection in DLP ePO extension
SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to …
-
Unscored —
SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arb…
-
Unscored —
SQL injection vulnerability in Sourcecodester South Gate Inn Online Reservation System v1 by oretnom23, allows attacker…
-
Unscored —
Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tu…
-
Unscored —
SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows att…
-
Unscored —
SQL injection vulnerability in Sourcecodester Storage Unit Rental Management System v1 by oretnom23, allows attackers t…
-
Unscored —
SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to …
-
Unscored —CVE-2022-22296 Public exploit
Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parame…
-
Unscored —
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it in…
-
High 8.0
Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm
Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
-
Unscored —
Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
-
Unscored —CVE-2021-25080 EPSS 84%
Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged…
-
Unscored —CVE-2021-25079 Scanner template
Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page