Archive
April 2022
Vulnerabilities first published in this month (UTC), newest first.
59 results · Clear filters · Feed
-
Low 3.5
automad Dashboard cross site scripting
A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scrip…
-
Low 3.8
Cross-site Scripting (XSS) in livehelperchat/livehelperchat
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
-
Low 3.5
Emlog Pro POST Parameter cross site scripting
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiat…
-
Low —
Keycloak is vulnerable to IDN homograph attack
A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.
-
Low 3.0
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible
-
Low 2.8
In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible
-
Low 2.3
In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characte…
-
Low —
Exposure of SSH credentials in Rancher/Fleet
### Impact This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories. A security vulnerability ([CVE-2022-29810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29810)) was discovered…
-
Low 3.3
A Malformed Lua script can crash Redis
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem i…
-
Low 3.9
Lua scripts can be manipulated to overcome ACL rules in Redis
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privil…
-
Low 3.9
An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys fro…
-
Low 3.7
IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user w…
-
Low 3.1
IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's…
-
Low 2.4
Insufficient Verification of Data Authenticity in Nextcloud Server
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not ne…
-
Low 2.2
Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts…
-
Low 2.0
Improper Authentication in Nextcloud Android Files
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the p…
-
Low 3.5
GetSimple CMS Content Module edit.php cross site scripting
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads t…
-
Low 3.1
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could h…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Low 3.7
Invitation Email is resent as a Reminder after invalidating pending email invites
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
-
Low 3.7
IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to …
-
Low 3.1
Security issues in Eaton Intelligent Power Manager Infrastructure
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastruct…
-
Low 3.7
Microsoft Power BI Spoofing Vulnerability
Microsoft Power BI Spoofing Vulnerability
-
Low 3.3
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers with command line access to access the device’s Wi-Fi module.
-
Low 3.4
WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
-
Low 3.3
Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon
SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.
-
Low 3.5
A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service
Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leadi…
-
Low 3.3
ICSA-22-090-03 Fuji Electric Alpha5
The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information.
-
Low 3.3
ICSA-22-090-03 Fuji Electric Alpha5
The affected product is vulnerable due to an invalid pointer initialization, which may lead to information disclosure.
-
Low 2.6
Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior…
-
Low 2.7
WordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerability
Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70
-
Low 3.3
Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to acc…