Archive
6 July 2022
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
Medium 4.3
Cisco Unified Communications Manager Arbitrary File Read Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary fil…
-
Medium 6.5
Cisco Unified Communications Products Access Control Vulnerability
A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote atta…
-
Medium 6.1
Cisco Unified Communications Products Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) …
-
Medium 6.1
Cisco Unified Communications Products Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unifi…
-
Medium 6.5
Cisco Unified Communications Products Arbitrary File Read Vulnerability
A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified…
-
Medium 4.9
Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the st…
-
Medium 5.3
Cisco Unified Communications Products Timing Attack Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This…
-
Medium 4.0
HCL Launch could disclose sensitive database information to a local user in plain text.
HCL Launch may store certain data for recurring activities in a plain text format.
-
Medium 4.9
HCL Launch is vulnerable to information disclosure which can be read by a local user.
HCL Launch stores user credentials in plain clear text which can be read by a local user.
-
Medium —
DOS and excessive memory usage when passing untrusted user input to to dag import
### Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running `ipfs dag import` on untrusted user inputs, for example, pinning services with a car ingest endpoint. This in…
-
Medium —
Malformed CAR panics and excessive memory usage
### Impact **Versions impacted** * `<=` go-car@v0.3.3 * `<=` go-car@v2.3.0 **Description** Decoding CAR data from untrusted user input can cause: - Panics: - Out of bound memory access - Out of memory - Divide by zero - Excessive memory usage Such panics can …
-
Medium 5.4
Ownership check missing when updating or deleting mail attachments in Nextcloud mail
Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incor…
-
Medium 5.3
Discrepency in transfer value and actual value due to incorrect truncation in Frontier
Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer va…
-
Medium 5.9
Agile Point - Agile Point NX SQL injection (SQLi)
Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/…
-
Medium 5.5
Priority - Priority web Insecure direct object references (IDOR)
this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to cl…
-
Medium 5.5
Priority - Priority User Enumeration
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.
-
Medium 4.3
Improper access to dataset metadata information
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
-
Medium 4.9
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Adm…
-
Medium 6.1
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one…