Archive
6 February 2022
Vulnerabilities first published on this day (UTC), newest first.
11 results · Feed
-
Unscored —
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.
-
Unscored —
An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/…
-
Unscored —
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Aut…
-
Unscored —
Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affec…
-
Unscored —
A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust th…
-
Unscored —
A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on e…
-
Unscored —
A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old …
-
Unscored —
A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input…
-
High 7.5
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
-
Critical 9.8
Buffer overrun in CGI.escape_html
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 …