Archive
28 January 2022
Vulnerabilities first published on this day (UTC), newest first.
167 results · Feed
-
Unscored —
A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 co…
-
Unscored —
A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to…
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Servi…
-
High 8.0
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker…
-
Unscored —
A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits…
-
Unscored —
A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits…
-
Unscored —
A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that…
-
Unscored —
A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward re…
-
Unscored —
A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized…
-
Unscored —
A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifi…
-
Unscored —
A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker t…
-
Unscored —
A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user o…
-
Unscored —
A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user o…
-
High 8.8
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
-
Unscored —
There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is a…
-
High 7.8
Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for val…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-craft…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-cr…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-c…
-
High 8.8
A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be repla…
-
Unscored —
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-serv…
-
Unscored —
Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firm…
-
Unscored —
Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inje…
-
Unscored —
A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a…
-
Unscored —
SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows…
-
Unscored —
A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foregrou…
-
Unscored —
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.
-
Unscored —
A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.…
-
Unscored —
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.
-
Unscored —CVE-2021-45897 Public exploit
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
-
Unscored —
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
-
Unscored —
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login po…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the…
-
Unscored —
An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD…
-
Unscored —
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inj…
-
Medium 5.3
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
-
Medium 4.9
SQL injection using custom CSS administration form in GLPI
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Enti…
-
Medium 6.1
Reflected XSS using reload button in GLPI
GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
-
Unscored —
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which cou…
-
Unscored —
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inj…