Archive
27 June 2022
Vulnerabilities first published on this day (UTC), newest first.
129 results · Feed
-
Unscored —
Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows …
-
Low 3.5
Admin Custom Login Plugin Persistent cross site scripting
A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely.
-
High 7.3
Analytics Stats Counter Statistics Plugin code injection
A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
-
Unscored —
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usi…
-
Unscored —
Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password…
-
Unscored —
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Su…
-
Medium 6.5
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to …
-
High 7.5
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to …
-
Unscored —
In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapac…
-
High 7.5
Denial of service in readExternal method
The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and wr…
-
Unscored —
When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cau…
-
Unscored —
When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter …
-
Unscored —
When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three…
-
Unscored —
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it wi…
-
Unscored —
When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes element, it wi…
-
Unscored —
When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater th…
-
Unscored —
When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will…
-
Unscored —
When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operato…
-
Low 3.8
Elcomplus SmartICS Path Traversal
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
-
High 8.8
Elcomplus SmartICS Cross-site Scripting
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
-
Medium 6.8
Elcomplus SmartICS Access Control
An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.
-
Medium 4.4
Album Lock getImage path traversal
A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The expl…
-
Low 3.5
ProjectSend information disclosure
A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate…
-
Low 3.5
Air Transfer cross site scripting
A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been dis…
-
Critical 9.4
Server-Side Request Forgery (SSRF) in ionicabizau/parse-url
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
-
Critical 9.1
Cross-site Scripting (XSS) - Stored in ionicabizau/parse-url
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating …
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted i…
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when download…
-
Medium 4.8
Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying craf…
-
Critical 9.1
Cross-site Scripting (XSS) - Generic in ionicabizau/parse-url
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splittin…
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafte…
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted …
-
Unscored —
Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element Content
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
-
Unscored —
Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element URL
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
-
Unscored —
miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting
The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is di…
-
Unscored —
Google Authenticator < 1.0.8 - Admin+ Stored Cross-Site Scripting
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed