Archive
30 August 2022
Vulnerabilities first published on this day (UTC), newest first.
18 results · Clear filters · Feed
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
-
Medium 6.0
An insufficiently protected credential vulnerability affects HCL VersionVault Express
HCL VersionVault Express exposes administrator credentials.
-
Medium —
Captcha Bypass in strapi-plugin-ezforms
### Impact Users using any captcha providers ### Patches >0.1.0 ### References [Issue](https://github.com/excl-networks/strapi-plugin-ezforms/issues/15)
-
Medium —
Cleartext Transmission of Sensitive Information in moment-timezone
### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploi…
-
Medium 6.1
Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Pe…
-
Medium 5.4
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could p…
-
Medium 4.3
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels
### Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes pod deploy rights (either directly or…
-
Medium —
iana-time-zone vulnerable to use after free in MacOS / iOS implementation
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced. The copied system time zone was released before its name was copied. If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`, ra…
-
Medium —
mz-avro's incorrect use of `set_len` allows for un-initialized memory
Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation. Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buf…
-
Medium 6.8
IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open re…
-
Medium 6.5
XXE vulnerability in DLP Endpoint for Windows
Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully const…
-
Medium 5.4
Cross-site Scripting (XSS)
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
-
Medium 6.5
Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and …
-
Medium 6.5
Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffe…
-
Medium 6.5
Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service.
-
Medium 6.5
Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buf…