Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in re…
-
Medium 5.5CVE-2022-0219 Public exploit
Improper Restriction of XML External Entity Reference in skylot/jadx
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.
-
Unscored —
Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to…
-
Unscored —
The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” fe…
-
Unscored —
Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
-
Unscored —
PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal…
-
Unscored —
Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
-
Medium 5.5
MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all…
-
Unscored —
Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumptio…
-
Medium 5.5CVE-2021-34600 Public exploit
Telenot complex: Insecure AES Key Generation
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
-
Medium 4.3
Cross-site Scripting in microweber/microweber
Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber
Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in zulip/zulip
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
-
Unscored —
Access-Token in ElasticJob UI causes password disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere E…
-
Medium 6.5
Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver
In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
-
High 7.2
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
-
Unscored —
In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicio…
-
Medium 6.5
Incorrect Permission Assignment for Critical Resource in microweber/microweber
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
-
High 7.3CVE-2022-21658 Public exploit
Race condition in std::fs::remove_dir_all in rustlang
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…
-
Unscored —
Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stac…
-
Unscored —
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attribu…
-
Unscored —
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF lo…
-
Unscored —
mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog ta…
-
Unscored —
mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CS…
-
Unscored —
A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list i…
-
High 8.1
Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton
Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
-
Medium 5.0
Privileged Escalation in Istio
Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this p…
-
Medium 6.8
Authorization Policy bypass in Istio
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade fro…
-
High 8.2
Execution with Unnecessary Privileges in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not p…
-
Medium 5.4
WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion
Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
-
Unscored —
PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" paramete…
-
Unscored —
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a s…
-
High 8.8
Lack of authentication mechanisms on the device
The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can ci…
-
Medium 5.7
Use of Hard-coded Cryptographic Key
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exp…
-
Unscored —CVE-2021-26247 Scanner template
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" …
-
Unscored —
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the …
-
Unscored —
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix f…
-
High 8.0
TIBCO EBX vulnerabilities
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a l…