Archive
3 November 2022
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
High 8.8
Remote Code Execution through dashboard PDF generation component in Splunk Enterprise
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
-
Medium 6.4
Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.
-
Low 3.8
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticate…
-
Low 3.8
Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A…
-
Medium 4.3
WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.
-
Medium 4.4
A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerabi…
-
Low 2.7
WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
-
Medium 5.9
WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
-
Medium 4.7
A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthent…
-
Medium 5.4
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…
-
Medium 5.3
Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the confi…
-
Medium 5.3
A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow…
-
Medium 4.8
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker …
-
Medium 5.4
WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and W…
-
High 7.5
A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remot…
-
Medium 5.8
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exp…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Man…
-
Medium 5.4
A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and W…
-
High 7.1
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…
-
Medium 5.4
WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
-
High 8.3
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthen…
-
High 7.7
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenti…
-
Medium 5.4
WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings.
-
Medium 5.8
A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (Do…
-
Medium 4.8
WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.
-
High 8.4
Sensitive Information store in NSClient logs
Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before w…
-
Medium 6.5
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of …
-
Medium 6.6
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…
-
Medium 6.5
An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.
OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot.
-
Medium 6.2
Arbitrary file read via download_server.
OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the device and reveal any file from the filesystem that is accessible to download_server service which …
-
High 8.4
Multiple path traversal in appspawn and nwebspawn services.
OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unpri…
-
Medium 6.6
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…
-
High 7.2
A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled co…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
High 8.8
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenti…
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…