Archive
21 April 2022
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Critical 9.1
Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, a…
-
Medium 6.1
Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution
ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or san…
-
Unscored —
A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lac…
-
Unscored —
An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does …
-
Unscored —
Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum w…
-
Unscored —
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity …
-
Unscored —
A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of t…
-
Unscored —
An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not …
-
Medium 5.3
Potential Secrets being logged to disk in CVEProject/cve-services
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be availab…
-
Medium 4.6
Cross Site Scripting in GLPI
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may all…
-
High 7.3
Cross site scripting via SVG file upload in GLPI
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their…
-
High 7.5
LDAP password exposure in glpi
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and w…
-
Critical 9.3
Cross-site Scripting in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are…
-
High 8.7
Stored Cross-site Scripting in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized user…
-
Medium 5.4
IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Medium 5.4
IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb…
-
Critical 9.3
XSS in csvimport in 3.0.0-beta versions
Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are…
-
High 7.3
Improper Restriction of XML External Entity Reference in detekt/detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
-
High 8.1
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
-
Medium 6.5
MongoDB Server (mongod) may crash in response to unexpected requests
An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions,…
-
Unscored —
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. D…
-
High 7.5
SQL injection in blazer
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.
-
Unscored —
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
-
Unscored —
The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions t…
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
-
Medium 4.6
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,…