Archive
3 November 2022
Vulnerabilities first published on this day (UTC), newest first.
60 results · Clear filters · Feed
-
Medium 6.4
Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.
-
Medium 4.3
WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.
-
Medium 4.4
A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerabi…
-
Medium 5.9
WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
-
Medium 4.7
A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthent…
-
Medium 5.4
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…
-
Medium 5.3
Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the confi…
-
Medium 5.3
A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow…
-
Medium 4.8
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker …
-
Medium 5.4
WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and W…
-
Medium 5.8
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exp…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Man…
-
Medium 5.4
A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and W…
-
Medium 5.4
WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
-
Medium 5.4
WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings.
-
Medium 5.8
A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (Do…
-
Medium 4.8
WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.
-
Medium 6.5
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of …
-
Medium 6.6
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…
-
Medium 6.5
An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.
OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot.
-
Medium 6.2
Arbitrary file read via download_server.
OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the device and reveal any file from the filesystem that is accessible to download_server service which …
-
Medium 6.6
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code d…
-
Medium 6.3
Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes…
-
Medium 6.4
Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.
-
Medium 6.7
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary…
-
Medium 6.7
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble…
-
Medium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dash…
-
Medium 6.5
"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authen…
-
Medium 4.3
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.…
-
Medium 5.4
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 4.3
Improper access to debug panel in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI…
-
Medium 4.5
Cross-Site Scripting (XSS) through public RSS feed in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicio…
-
Medium 4.7
user session persists even after permanently deleting account in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as…
-
Medium 5.2
Stored Cross-Site Scripting (XSS) on login page in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be u…
-
Medium 4.9
Stored Cross-Site Scripting (XSS) in entity name in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This iss…
-
Medium 4.5
Cross-Site Scripting (XSS) in external links in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be …
-
Medium 5.3
IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.
-
Medium 5.9
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to condu…
-
Medium 5.4
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…