Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
66 results · Clear filters · Feed
-
Low 3.9
HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
-
Low 3.5
SourceCodester Garage Management System createUser.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Garage Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument userName with the input lala<img src="" on…
-
Low 3.6
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was miss…
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
-
Low 3.3
Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted
Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
-
Low 3.1
Jenkins GitHub plugin uses weak webhook signature function
Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
-
Low 3.1
IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker …
-
Low 3.5
Stored Cross Site-Scripting in Agent Manager
In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
Low 3.5
Stored Cross Site-Scripting in File Manager
In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
Low 3.4
WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.
-
Low 3.7
Uncleared cookies on cross-host/cross-origin redirect in undici
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental le…
-
Low 3.1
WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.
-
Low 3.4
WordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.
-
Low 3.4
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…
-
Low 2.5
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client). Supported versions th…
-
Low 2.7
Vulnerability in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server. Supported…
-
Low 3.8
GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…
-
Low 2.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Rea…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected v…
-
Low 3.3
Cilium host policy bypass in endpoint-routes mode with dual-stack
### Impact This vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace (e.g., to a host-network pod). Host policy enforcement on IPv4 or for traffic coming from outside the nod…
-
Low 3.0
IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be us…
-
Low 3.8
IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extensi…
-
Low 3.7
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information c…
-
Low 3.5
SourceCodester Simple e-Learning System claire_blake cross site scripting
A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(d…
-
Low 2.6
Cross-site Scripting for Argo CD single sign on users
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/cal…
-
Low 3.7
IBM QRadar SIEM 7.3, 7.4, and 7.5 may be vulnerable to partial denial of service attack, resulting in some protocols no…
-
Low 3.5
SourceCodester Simple Parking Management System category cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>al…
-
Low 3.5
SourceCodester Simple Parking Management System cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument se…
-
Low 3.5
SourceCodester Simple Sales Management System create cross site scripting
A vulnerability classified as problematic was found in SourceCodester Simple Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ci_ssms/index.php/orders/create. The manipulation of the argument customer_name w…