Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
2,085 results · Feed
-
Medium 4.3
CSRF vulnerability in Jenkins RocketChat Notifier Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
-
Medium 4.3
Missing permission check in Jenkins JiraTestResultReporter Plugin
A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
High 8.8
CSRF vulnerability and missing permission check in Jenkins JiraTestResultReporter Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 6.5
Plaintext storage in Jenkins instant-messaging Plugin
Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the…
-
Medium 5.4
Missing permission checks in Jekins Bitbucket Server Integration Plugin
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account t…
-
Unscored —
A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
-
Medium 4.8
Shopizer - Stored XSS in Manage Images
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
-
High 7.2
Insecure deserialization of not validated module file in crater-invoice/crater
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
-
Critical 9.1
Firebase PHP-JWT key/algorithm type confusion
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. N…
-
Low 3.5
htmly Edit Profile Module cross site scripting
A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remote…
-
Low 3.5
DolphinPHP User Management Page cross site scripting
A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the p…
-
Low 3.5
CLTPHP POST Parameter cross site scripting
A vulnerability was found in CLTPHP up to 6.0. It has been declared as problematic. Affected by this vulnerability is the POST Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos…
-
High 7.3
SourceCodester One Church Management System Session userregister.php improper authentication
A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authentication bypass. The atta…
-
High 7.3
Microfinance Management System sql injection
A vulnerability classified as critical has been found in Microfinance Management System. The manipulation of arguments like customer_type_number/account_number/account_status_number/account_type_number with the input ' and (select * from(select(sleep(10)))Avx…
-
High 7.3
SourceCodester Microfinance Management System Login Page login.php sql injection
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of the Login Page. The manipulation of the argument username/password with the input '||1=1# leads to sq…
-
Medium 4.3
SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname le…
-
High 7.3
SourceCodester One Church Management System attendancy.php sql injection
A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file attendancy.php as the manipulation of the argument search2 leads to sql injection. The attack can be in…
-
Medium 4.3
SourceCodester One Church Management System churchprofile.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely.
-
High 7.3
SourceCodester College Website Management System sql injection
A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=articles/view_article/. The manipulation of the argument id with the input ' and (select * from(selec…
-
Medium 5.3CVE-2022-1077 Public exploit
TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated…
-
Medium 4.3
Automatic Question Paper Generator System My Account Page login.php cross site scripting
A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name …
-
Low 3.5
College Website Management System Contact cross site scripting
A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scri…
-
Medium 4.3
TEM FLEX-1085 injection
A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashboard leads to html injection.
-
High 7.3
Automatic Question Paper Generator password recovery
A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely.
-
Medium 5.3
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exch…
-
Unscored —
DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit…
-
Unscored —
An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2bor…
-
Unscored —
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows a…
-
Unscored —
An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter.
-
Unscored —
A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functi…
-
Unscored —
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via…
-
Unscored —CVE-2022-26269 Public exploit
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
-
Medium 5.3
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest drive…
-
Unscored —
NUUO v03.11.00 was discovered to contain access control issue.
-
High 8.8
SaltStack Salt Authentication Bypass by Capture-replay
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …
-
High 8.8
SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
-
Low 3.7
SaltStack Salt Improper Authentication via Man in the Middle Attack
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.