Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
2,085 results · Feed
-
Critical 10.0
Command Injection vulnerability in asciidoctor-include-ext
Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host oper…
-
High 8.1
Prototype Pollution in deepmerge-ts
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There ar…
-
High 7.5
Insufficient password hash filtering in some IRRd queries and exports
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries…
-
High 8.1
Use after free in Wasmtime
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch …
-
High 7.5
Open Redirect in express-openid-connect
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when th…
-
Critical 10.0
Remote Command Injection in RaspberryMatic
RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of Ras…
-
Medium 6.5
Exposure of Sensitive Information in Pomerium
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited…
-
High 7.5
Insertion of Sensitive Information into Log File affects Jupyter Notebook
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are re…
-
Unscored —
Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via …
-
Unscored —
Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a …
-
Unscored —
Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code vi…
-
Unscored —
Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a …
-
Unscored —
FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch pr…
-
Unscored —
BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attacker…
-
Unscored —
Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files b…
-
Unscored —
D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to f…
-
Unscored —
Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensiti…
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
-
Unscored —
A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.
-
Unscored —
A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in …
-
Unscored —
A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the fail…
-
High 7.5
Access Control vulnerability in Dolibarr
An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name param…
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config,…
-
Unscored —
A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting…
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name param…
-
High 8.8
SQL Injection in Dolibarr
An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
-
Medium 4.8
IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or p…
-
Unscored —
An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter …
-
Unscored —
Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1)…
-
High 8.8
Unrestricted Upload of File with Dangerous Type in WPanel 4
Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
-
Unscored —
Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentr…
-
High 7.5
Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat
Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
-
Unscored —
Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmw…
-
High 8.7
SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat
SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
-
Unscored —
Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and ex…
-
Unscored —
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an ar…
-
Unscored —
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and p…