Archive
16 May 2022
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
Medium 5.6
xArrow SCADA Path Traversal
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
-
Medium 6.1
xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
-
Medium 6.1
xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
-
Medium 4.3
Improper Output Neutralization for Logs in Crafter Studio
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
-
Medium 5.5
Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractin…
-
Medium 5.5
Apache Tika BPGParser Memory Usage DoS
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
-
Medium 6.8
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
-
Medium 5.5
Reflected XSS on ticket filter function in polonel/trudesk
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
-
Medium 5.3
Code Injection in publify/publify
Code Injection in GitHub repository publify/publify prior to 9.2.8.
-
Medium 5.3
Improper Access Control in publify/publify
Improper Access Control in GitHub repository publify/publify prior to 9.2.8.
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
-
Medium 6.6
Buffer Over-read in function grab_file_name in vim/vim
Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.