Archive
2 March 2022
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attac…
-
Medium 5.3
Liferay Portal and Liferay DXP fails to check origin of event messages
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF tok…
-
Medium 5.4
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script…
-
Unscored —
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats proje…
-
Unscored —
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCA…
-
Medium 5.4
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_port…
-
Unscored —
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats proje…
-
Medium 6.1
Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console
Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web scri…
-
Unscored —
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access a…
-
Medium 6.1
Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an…
-
Medium 5.4
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title…
-
High 7.5
Liferay Portal and Liferay DXP fails to properly import users from LDAP
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from…
-
High 8.1
Cross-site Scripting in view_component
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received …
-
Unscored —
Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.
-
Unscored —
Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
-
Unscored —
Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.
-
Unscored —
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
-
Unscored —
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
-
Unscored —
Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search p…
-
Unscored —
Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) …
-
Unscored —
Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter unde…
-
Unscored —
Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
-
Unscored —
A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners …
-
Unscored —
Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name …
-
Unscored —
A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to e…
-
Unscored —
A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() …
-
Unscored —
A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to ex…
-
Unscored —
A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys.
-
Unscored —
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM…
-
Unscored —
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the…
-
Medium 6.5
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it wh…
-
Unscored —
A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal va…
-
Unscored —CVE-2022-0711 EPSS 17%
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow…
-
Unscored —
Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200…
-
Unscored —
Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Ar…
-
Unscored —
Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Ar…
-
Unscored —
An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aru…
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.