Archive
13 October 2022
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Medium 5.4
Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114…
-
Medium 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_read_header at /src/png2swf.c.
-
Medium 6.5
Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
-
Medium 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_load at /lib/png.c.
-
Medium 5.4
Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
-
Medium 4.3
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web script…
-
Medium 6.2
October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming…
-
Medium 6.1
Improper Neutralization of Alternate XSS Syntax in Knowage-Server
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSReq…
-
Medium 5.5
Ree6 may bypass webhook protection
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel …
-
Medium 4.3
Grafana users with email as a username can block other users from signing in
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username a…
-
Medium 6.8
Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plug…
-
Medium 5.4
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experien…
-
Medium 6.1
Grafana plugin signature bypass vulnerability
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious p…
-
Medium 4.9
Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and …
-
Medium 6.3
SourceCodester Human Resource Management System Profile Photo os command injection
A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os command injection. …
-
Medium 5.6
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
-
Medium 6.5
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure …
-
Medium 6.5
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change…
-
Medium 6.1CVE-2022-41473 Scanner template
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
-
Medium 5.5
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could…
-
Medium 4.3
D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.