Archive
29 March 2022
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
High 7.3
SourceCodester Microfinance Management System Login Page login.php sql injection
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of the Login Page. The manipulation of the argument username/password with the input '||1=1# leads to sq…
-
Medium 4.3
SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname le…
-
High 7.3
SourceCodester One Church Management System attendancy.php sql injection
A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file attendancy.php as the manipulation of the argument search2 leads to sql injection. The attack can be in…
-
Medium 4.3
SourceCodester One Church Management System churchprofile.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely.
-
High 7.3
SourceCodester College Website Management System sql injection
A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=articles/view_article/. The manipulation of the argument id with the input ' and (select * from(selec…
-
Medium 5.3CVE-2022-1077 Public exploit
TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated…
-
Medium 4.3
Automatic Question Paper Generator System My Account Page login.php cross site scripting
A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name …
-
Low 3.5
College Website Management System Contact cross site scripting
A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scri…
-
Medium 4.3
TEM FLEX-1085 injection
A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashboard leads to html injection.
-
High 7.3
Automatic Question Paper Generator password recovery
A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely.
-
Medium 5.3
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exch…
-
Unscored —
DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit…
-
Unscored —
An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2bor…
-
Unscored —
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows a…
-
Unscored —
An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter.
-
Unscored —
A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functi…
-
Unscored —
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via…
-
Unscored —CVE-2022-26269 Public exploit
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
-
Medium 5.3
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest drive…
-
Unscored —
NUUO v03.11.00 was discovered to contain access control issue.
-
High 8.8
SaltStack Salt Authentication Bypass by Capture-replay
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …
-
High 8.8
SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
-
Low 3.7
SaltStack Salt Improper Authentication via Man in the Middle Attack
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
-
High 8.8
SaltStack Salt Permissions Bypass
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…