Archive
November 2022
Vulnerabilities first published in this month (UTC), newest first.
2,049 results · Feed
-
Medium 4.1
A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via …
-
Medium 4.7
Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that al…
-
Medium 6.5
HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
-
High 7.2
A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run a…
-
Medium 4.9
An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Succes…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
Medium 4.9
An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful expl…
-
Medium 5.5
A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to co…
-
Medium 6.1
A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.2
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbi…
-
High 7.5
A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this conditi…
-
High 8.8
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920…
-
Unscored —
The Social Base theme is designed as a base theme for Open Social. This base theme holds has a lot of sensible defaults…
-
Medium 5.3
Information disclosure in M-Files Server
Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.
-
Low 2.4
Incorrect privilege assignment in M-Files Server
Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.
-
Medium 5.3
WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
-
Medium 5.4
WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.
-
Unscored —
parity-util-mem Unmaintained
The crate has been deprecated and will receive no updates with no repository source. The crate has [a warning](https://crates.io/crates/parity-util-mem) surrounding it's use related to global allocator use that may lead to UB.
-
Medium 6.7
An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This all…
-
High 8.6
Denial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface Module
Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120ENCPU Network Part Firmware version "65" and prior al…
-
Medium 5.0
SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injection
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_invoice.php of the component POST Request Handler. The manipulation of the argument search leads to sq…
-
Medium 5.3
SourceCodester Book Store Management System information disclosure
A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/index.php/user/edit_user/. The manipulation of the argument password leads to information disclosure…
-
Medium 4.2
Tribal Systems Zenario CMS Remember Me session fixiation
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initi…
-
High 7.3
SourceCodester Book Store Management System index.php access control
A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_ci/index.php. The manipulation leads to improper access controls. The attack can be initiated remote…
-
Low 3.5
SourceCodester Canteen Management System brand.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the file youthappam/brand.php. The manipulation of the argument brand_name leads to cross site scripting. …
-
Low 2.4
SourceCodester Event Registration System cross site scripting
A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /event/admin/?page=user/list. The manipulation of the argument First Name/Last…
-
Medium 4.7
SourceCodester Event Registration System unrestricted upload
A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB…
-
Medium 6.8
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An…
-
Medium 5.4
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind c…
-
Medium 6.2
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual…
-
Medium 5.8
Code Injection
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed…
-
High 7.2
Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network a…
-
Medium 6.5
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device no…
-
Medium 5.4
Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out…
-
High 8.8
Discourse BBCode plugin vulnerable to arbitrary CSS injection
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin inst…