Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
98 results · Clear filters · Feed
-
Low 2.4
SourceCodester Prison Management System System Name cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=system_info of the component System Name Handler. The manipulati…
-
Low 3.7
Failed payment recorded has completed in silverstripe/silverstripe-omnipay
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is po…
-
Low 2.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions star…
-
Low 3.5
SialWeb CMS Search cross site scriting
A vulnerability has been found in SialWeb CMS and classified as problematic. This vulnerability affects unknown code of the component Search Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been di…
-
Low 3.7
Klapp App JSON Web Token improper authentication
A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely.
-
Low 3.5
Server Status HTTP Status/SMTP Status cross site scripting
A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/SMTP Status. The manipulation leads to cross site scripting. The attack may be initiated remotely. T…
-
Low 3.5
Countdown Timer Macro cross site scripting
A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclose…
-
Low 3.5
Linking New Windows Macro cross site scripting
A vulnerability classified as problematic has been found in Linking. This affects an unknown part of the component New Windows Macro. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclose…
-
Low 3.5
Refined Toolkit UI-Image/UI-Button cross site scripting
A vulnerability was found in Refined Toolkit. It has been rated as problematic. Affected by this issue is some unknown functionality of the component UI-Image/UI-Button. The manipulation leads to cross site scripting. The attack may be launched remotely. The …
-
Low 3.5
PlantUML Database Information Macro cross site scripting
A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database Information Macro. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has b…
-
Low 2.6
Invite bypasses user approval in Discourse
Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check …
-
Low 3.5
Fast Food Ordering System Master List Master.php cross site scripting
A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> lead…
-
Low 2.5
Buffer Over-read in bfabiszewski/libmobi
Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
-
Low 3.7
Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unau…
-
Low —
Cross site scripting via cookies in gogs
### Impact There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self. ### Patches Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the late…
-
Low 2.4
SourceCodester Product Show Room Site cross site scripting
A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> lea…
-
Low 3.5
SourceCodester Product Show Room Site p=contact cross site scripting
A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. …
-
Low 2.3
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustment…