Archive
24 October 2022
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Medium 6.5
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privi…
-
Critical 9.8
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command In…
-
Medium 6.1
OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.
-
Medium 5.5
Juiker app - Hard-coded Credentials
Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.
-
Medium 5.5
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT f…
-
Medium 4.8
User enumeration in the code-based login and password reset forms
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `pas…
-
Medium 5.5
An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT f…
-
Critical 9.8
Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in…
-
High 7.5
Parse Server crashes when receiving file download request with invalid byte range
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a …
-
Critical 9.8
Skipper vulnerable to SSRF via X-Skipper-Proxy
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
-
Medium 4.8
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows …
-
Medium 6.5
In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecod…
-
Medium 5.5
A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept t…
-
Critical 9.8
Stack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 …
-
Medium 5.4
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inje…
-
Medium 6.5
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5…
-
Medium 6.5
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) al…
-
High 7.8
Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an atta…
-
High 7.5
Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain…
-
Medium 5.5
free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders
In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
Medium 5.8CVE-2021-4228 EPSS 10%
Hard-coded TLS Certificate
Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.
-
Medium 5.8
Session Fixation and Insufficient Session Expiration
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
High 7.2
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. A…
-
Critical 9.1
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
-
Medium 5.3
Username Enumeration
Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
Medium 6.5
spx_restservice SubNet_handler_func Broken Access Control
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard fir…
-
Medium 5.3
spx_restservice KillDupUsr_func Broken Access Control
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This …
-
Medium 4.9
TLS Certificate Generation Function Improper Input Validation
An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can only be reverted via a factory reset. This issue affects: Lanner Inc IAC-AST2500A standard firmware…
-
Critical 9.8
CRLF log injection
Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.
-
Medium 6.5
spx_restservice First_network_func Broken Access Control
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
Critical 10.0
spx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer Overflows
Multiple command injections and stack-based buffer overflows vulnerabilities in the SubNet_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc …
-
Critical 10.0
spx_restservice Login_handler_func Command Injection and Multiple Stack-Based Buffer Overflows
Command injection and multiple stack-based buffer overflows vulnerabilities in the Login_handler_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IA…
-
Critical 9.1
spx_restservice modifyUserb_func Command Injection and Multiple Stack-Based Buffer Overflows
Command injection and multiple stack-based buffer overflows vulnerabilities in the modifyUserb_func function of spx_restservice allow an authenticated attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: L…
-
Medium 5.3
spx_restservice FirstReset_handler_func Broken Access Control
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standa…
-
Critical 10.0
spx_restservice KillDupUsr_func Command Injection and Stack-Based Buffer Overflow
Command injection and stack-based buffer overflow vulnerabilities in the KillDupUsr_func function of spx_restservice allow an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A st…
-
Critical 10.0
spx_restservice Login_handler_func Subfunction Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability in a subfunction of the Login_handler_func function of spx_restservice allows an attacker to execute arbitrary code with the same privileges as the server user (root). This issue affects: Lanner Inc IAC-AST2500A sta…