Archive
8 February 2022
Vulnerabilities first published on this day (UTC), newest first.
18 results · Clear filters · Feed
-
Medium 5.0
Inadequate access verification when using proxy commands in ArchiSteamFarm
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending prox…
-
Medium 5.4
Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
-
Medium 6.1
Cross-site Scripting in Gitea
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
-
Medium 6.5
Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
-
Medium 6.3
Access of Memory Location Before Start of Buffer in radareorg/radare2
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
-
Medium 4.3
Exposure of Sensitive Information in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…
-
Medium 6.3
Access of Memory Location After End of Buffer in radareorg/radare2
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Cross Site Request Forgery in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…
-
Medium 6.3
Buffer Access with Incorrect Length Value in radareorg/radare2
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.5
Cross site scripting in Grafana proxy
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…
-
Medium 6.1CVE-2021-45328 Scanner template
Open redirect in Gitea
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
-
Medium 5.3
Gitea displaying raw OpenID error in UI
Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.
-
Medium 4.3
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
-
Medium 6.5
Server-Side Request Forgery (SSRF) in chocobozzz/peertube
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
-
Medium 6.5
Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.7
Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.