Archive
30 August 2022
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Fil…
-
Unscored —
PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index…
-
Unscored —
Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
-
High 7.5
Overload/denial of service affects HCL VersionVault Express
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
-
Medium 6.0
An insufficiently protected credential vulnerability affects HCL VersionVault Express
HCL VersionVault Express exposes administrator credentials.
-
Unscored —
Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /…
-
Medium —
Captcha Bypass in strapi-plugin-ezforms
### Impact Users using any captcha providers ### Patches >0.1.0 ### References [Issue](https://github.com/excl-networks/strapi-plugin-ezforms/issues/15)
-
High 7.1
Cross-site scripting from content entered in the tags and multiselect fields
### Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with …
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /adm…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /adm…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librari…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /lib…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /lib…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
-
Low —
Command Injection in moment-timezone
### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the t…
-
Medium —
Cleartext Transmission of Sensitive Information in moment-timezone
### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploi…
-
High 8.8
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote a…
-
High 8.8
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenti…
-
Medium 6.1
Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Pe…
-
Medium 5.4
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could p…
-
High 8.6
SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacke…
-
Medium 4.3
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels
### Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes pod deploy rights (either directly or…
-
Unscored —
An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijack…
-
Unscored —
Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers t…
-
Unscored —
Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attacke…
-
Unscored —
Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenti…
-
Unscored —
Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authent…
-
Unscored —
Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticat…
-
Unscored —
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
-
Medium —
iana-time-zone vulnerable to use after free in MacOS / iOS implementation
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced. The copied system time zone was released before its name was copied. If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`, ra…
-
Medium —
mz-avro's incorrect use of `set_len` allows for un-initialized memory
Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation. Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buf…
-
Medium 6.8
IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open re…
-
Unscored —
An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below co…
-
Unscored —
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the W…
-
Unscored —
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which…
-
Unscored —
WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the …
-
Medium 6.5
XXE vulnerability in DLP Endpoint for Windows
Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully const…