Archive
25 May 2022
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
High 7.5
Potential secrets being logged to disk in CVE Services
CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not…
-
High 8.7
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute…
-
High 7.4
Cross-site Scripting in the Flamingo theme manager
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page relate…
-
High 7.4
Cross-site Scripting in XWiki Platform Wiki UI Main Wiki
XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" …
-
High 7.5
An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Soft…
-
High 7.5
An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Softwa…
-
High 7.5
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications f…
-
High 7.5
An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation So…
-
High 7.5
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software…
-
High 7.5
Path traversal in ginadmin
In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.
-
High 7.5
Arbitrary file read in ginadmin
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
-
High 8.2
Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort
The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500…
-
High 7.5
Buffer over-flow in Pillow
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
-
High 8.6
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 8.0
Cross-domain cookie leakage in Guzzle
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cooki…