Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
66 results · Clear filters · Feed
-
Low 3.5
SourceCodester Apartment Visitor Management System manage-apartment.php cross site scripting
A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /manage-apartment.php. The manipulation of the argument Apartment Number with the input…
-
Low 3.5
SourceCodester Simple Food Ordering System login.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Food Ordering System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument email/password with the input "><ScRiPt>alert(1)</sCrIpT> …
-
Low 3.5
SourceCodester Alphaware Simple E-Commerce System stockin.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Alphaware Simple E-Commerce System. Affected by this issue is some unknown functionality of the file stockin.php. The manipulation of the argument id with the input '"><scr…
-
Low 3.5
SourceCodester Online Student Admission System Student User Page edit-profile.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Student Admission System. Affected by this vulnerability is an unknown functionality of the file edit-profile.php of the component Student User Page. The manipulation with the input …
-
Low 2.4
Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chr…
-
Low 3.3
Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers …
-
Low 3.3
Unprotected dynamic receiver in Samsung Galaxy Friends prior to SMR Aug-2022 Release 1 allows attacker to launch activi…
-
Low 3.3
Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to acces…
-
Low 2.3
An absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitia…
-
Low 3.3
Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to acce…
-
Low 2.7
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before …
-
Low 2.2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions start…
-
Low 3.5
A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions start…
-
Low 3.5
An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starti…
-
Low 3.7
BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed…
-
Low 3.1
Password disclosure in log file in Nextcloud Mail App
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected ac…
-
Low 2.1
Federated share accepting/declining is not logged in audit log in Nextcloud Server
Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force atta…
-
Low 3.5
SourceCodester Online Admission System index.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.php. The manipulation of the argument eid with the input 8</h3><script>alert(1)</script> leads to cros…
-
Low 3.5
SourceCodester Garage Management System edituser.php cross site scripting
A vulnerability has been found in SourceCodester Garage Management System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file edituser.php. The manipulation of the argument id with the input 1\"><ScRiPt>alert(…
-
Low 3.3
OpenStack Nova Changing vnic_type breaks compute service restart
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, a…
-
Low 3.5
User preference to prevent private discussions not respected in fof/byobu
fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with F…
-
Low 3.3
Leakage of excessive information into log in next-auth
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as …
-
Low 2.7
Possible to infer sensitive information through query strings in Flask-AppBuilder
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using …
-
Low 3.4
WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
-
Low 3.7
Cross-Site Request en Bulk operation (User operation)
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
-
Low 3.7
Improper Access Control in Configuration (Credential store)
Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.