Archive
26 August 2022
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /p…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settin…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitr…
-
Unscored —
A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to …
-
Unscored —
Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters a…
-
Unscored —
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tool…
-
Unscored —
The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new maliciou…
-
Unscored —
The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release m…
-
Unscored —
The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release…
-
Unscored —
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML fea…
-
Unscored —
A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values be…
-
High 7.5
XNIO `notifyReadClosed` method logging message to unexpected end
A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…
-
Medium 5.4
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
-
Unscored —
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…
-
Medium 5.4
IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
High 8.8
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an atta…
-
Unscored —
A malicious unauthorized PAM user can access the administration configuration data and change the values.
-
Unscored —
A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed i…
-
Unscored —
A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing …
-
Unscored —
A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployme…
-
Critical 9.1
Openstack Keystone Incorrect Authorization vulnerability
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confid…
-
High 7.5
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
-
Unscored —
A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the p…
-
Unscored —
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…
-
Unscored —
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while…
-
Low 3.3
wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should no…
-
Unscored —
It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHS…
-
Low 3.7CVE-2021-3754 Public exploit
Keycloak's improper input validation allows using email as username
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
-
Medium 4.3
Keycloak has Files or Directories Accessible to External Parties
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of ra…
-
Unscored —CVE-2021-3864 Public exploit
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. …
-
Unscored —
A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated…
-
Unscored —
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add …
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…