Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
49 results · Clear filters · Feed
-
Low 3.8
WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
-
Low 2.3
phar wrapper can occur dos when using quine gzip file
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
-
Low 3.3
An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows…
-
Low 3.7
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unau…
-
Low 3.3
readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
-
Low 3.5
Open5GS UDP Packet ogs-tlv-msg.c denial of service
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit h…
-
Low 2.7
SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.
-
Low 3.5
Zephyr Project Manager REST Call cross site scripting
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to…
-
Low 3.7
Apache Tomcat: Information disclosure
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.…
-
Low 1.8
Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exp…
-
Low 2.7
EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
-
Low 3.4
WordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.
-
Low 3.4
WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
-
Low 3.1
Server-side Denial of Service while processing a specifically crafted GIF file
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Den…
-
Low 3.4
WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
-
Low 3.7
Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Con…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Low 3.1
An injection vulnerability affects HCL Digital Experience
User input included in error response, which could be used in a phishing attack.
-
Low 3.7
Spring Data REST can expose hidden entity attributes
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests …
-
Low —
personnummer/rust vulnerable to Improper Input Validation
This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severi…
-
Low 3.3
Rapid7 InsightVM Information Disclosure after Logout
Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visi…
-
Low 3.7
Unrestricted Upload of File with Dangerous Type in octoprint/octoprint
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
-
Low 2.4
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A pers…
-
Low 3.2
Access to internal files of the Nextcloud Android app
Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possibl…
-
Low 3.0
Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommend…
-
Low —
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
### Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf [clients](https://github.com/theupdateframework/go-tuf#client) <…
-
Low 2.6
File list exposure in Nextcloud Files Access Control
Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextclo…
-
Low —
Python-TUF vulnerable to incorrect threshold signature computation for new root metadata
### Impact The function `_verify_root_self_signed()`, introduced in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0), and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towa…
-
Low 3.5
Blind Server-Side Request Forgery (SSRF) in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to…
-
Low 3.7
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the …
-
Low 3.0
Contec Health CMS8000
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify add…
-
Low 3.0
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could pote…
-
Low 2.0
Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with ph…
-
Low 2.3
Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator u…
-
Low 2.3
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated …
-
Low 2.3
Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potent…
-
Low 3.0
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could pote…
-
Low 3.1
Format String vulnerability
The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive in…
-
Low 3.9
Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data…
-
Low 1.9
Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read …