Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
381 results · Clear filters · Feed
-
Medium 5.4
Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
-
Medium 4.8
Shopizer - Stored XSS in Manage Images
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
-
Medium 4.3
SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname le…
-
Medium 4.3
SourceCodester One Church Management System churchprofile.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely.
-
Medium 5.3CVE-2022-1077 Public exploit
TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated…
-
Medium 4.3
Automatic Question Paper Generator System My Account Page login.php cross site scripting
A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name …
-
Medium 4.3
TEM FLEX-1085 injection
A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashboard leads to html injection.
-
Medium 5.3
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exch…
-
Medium 5.3
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial…
-
Medium 4.3
WEKA INTEREST Security Scanner Portscan memory allocation
A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be i…
-
Medium 5.3
Shemes GrabIt NZB Date Parser denial of service
A vulnerability, which was classified as problematic, was found in Shemes GrabIt up to 1.7.2 Beta 4. This affects the component NZB Date Parser. The manipulation of the argument date with the input 1000000000000000 as part of a NZB File leads to a denial of s…
-
Medium 5.5
Pro2col Stingray FTS cross site scriting
A vulnerability, which was classified as problematic, has been found in Pro2col Stingray FTS. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. It is recommended to upgrade the affected component. N…
-
Medium 5.4
Netegrity SiteMinder Login smpwservicescgi.exe redirect
A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical. Affected by this issue is the file /siteminderagent/pwcgi/smpwservicescgi.exe of the component Login. The manipulation of the argument target leads to an open redirect. …
-
Medium 5.0
ISS BlackICE PC Protection Update cross site scriting
A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remotely. The exploit has…
-
Medium 5.3
ISS BlackICE PC Protection Cross Site Scripting Detection privileges management
A vulnerability was found in ISS BlackICE PC Protection and classified as critical. Affected by this issue is the component Cross Site Scripting Detection. The manipulation as part of POST/PUT/DELETE/OPTIONS Request leads to privilege escalation. The attack m…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Pri…
-
Medium 4.7
An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLa…
-
Medium 5.4
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulner…
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of …
-
Medium 5.9
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
Medium 4.2
An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting f…
-
Medium 6.5
Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions star…
-
Medium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 befo…
-
Medium 6.1
Cross-site Scripting in teampass
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
-
Medium 5.3
Kiddoware Kids Place Home Button Protection denial of service
A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
-
Medium 5.5
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information …
-
Medium 5.3
Incorrect Access Control in ImpressCMS
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
-
Medium 5.5
Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff …
-
Medium 5.5
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
-
Medium 6.1
Cross-site Scripting in Keycloak
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
-
Medium 4.1
WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom…
-
Medium 4.1
WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
-
Medium 4.8
WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
-
Medium 6.1
Delta Electronics CNCSoft Out-of-bounds Read
Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, which may allow an attacker to disclose information.
-
Medium 4.3
F-Secure SAFE Browser vulnerable to USSD attacks
A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD mess…
-
Medium 4.5
Cross-Site Request Forgery in Anchor CMS
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
-
Medium 4.3
Secure category names leaked via user activity export in Discourse
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of …
-
Medium 6.1
Open Redirect in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3…
-
Medium 6.5
The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affe…