Archive
13 June 2022
Vulnerabilities first published on this day (UTC), newest first.
146 results · Feed
-
Unscored —
The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a ma…
-
Unscored —
Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP fi…
-
Unscored —
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and documen…
-
Unscored —
An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permi…
-
Unscored —
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
-
Unscored —
XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-contro…
-
Medium 6.6
Electron's AutoUpdater module fails to validate certain nested components of the bundle
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / up…
-
Low 2.2
Exposure of Resource to Wrong Sphere in Electron
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer…
-
Unscored —
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
-
Unscored —
An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during…
-
Unscored —
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.
-
Unscored —
An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager coo…
-
High 7.5
Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sen…
-
Critical 9.8
Signature forgery in Biscuit
Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to creat…
-
Unscored —
There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vul…
-
Unscored —
There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability m…
-
Unscored —
There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause …
-
Unscored —
The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerability may result in …
-
Unscored —
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated user…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: po…
-
Critical 9.8
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypa…
-
Critical 9.8
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions set…
-
Medium 5.9
Amodat - Mobile Application Gateway SQL Injection (SQLi)
attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.
-
Medium 5.9
Amodat - Mobile Application Gateway SQL Injection (SQLi)
The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--
-
Medium 5.3
Amodat - Mobile Application Gateway Local File Inclusion (LFI)
Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED.
-
Medium 4.7
WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
-
Unscored —
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untru…
-
High 7.5
Improper Access Control in kctf
kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want t…
-
Unscored —
Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect…
-
Unscored —
Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentialit…
-
Unscored —
Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of th…
-
Unscored —
Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the a…
-
Unscored —
HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause di…
-
Unscored —
The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of t…
-
Unscored —
The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affec…
-
Unscored —
The Device Manager has a vulnerability in multi-device interaction. Successful exploitation of this vulnerability may a…
-
Unscored —
Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploi…
-
Unscored —
The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privile…
-
Unscored —
AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affe…
-
Unscored —
The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulne…