Archive
25 July 2022
Vulnerabilities first published on this day (UTC), newest first.
15 results · Clear filters · Feed
-
Medium 5.3
IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in f…
-
Medium 6.8
IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, …
-
Medium 6.5
IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker …
-
Medium 5.3
IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite…
-
Medium 6.1CVE-2022-35653 Scanner template
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrar…
-
Medium 6.1
Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/d…
-
Medium 6.1
Moodle Stored XSS and blind SSRF possible via SCORM track details
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and s…
-
Medium 5.0
HTTP Response Splitting in Hitachi Energy’s MSM Product
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web brows…
-
Medium 5.0
Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF),…
-
Medium 6.5
Insecure Randomness
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
-
Medium 5.6
Prototype Pollution
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
-
Medium 4.9
Directory Traversal
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
-
Medium 6.4
Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function.
-
Medium 5.4
Cross-site Scripting (XSS)
The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
-
Medium 6.3
Tecrail Responsive Filemanger path traversal
A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to versi…