Archive
3 November 2022
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
High 7.2
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of…
-
Critical 9.8
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending speciall…
-
Low 3.7
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authenti…
-
Low 2.6
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB req…
-
High 8.8
VR Calendar <= 2.3.3 - Cross-Site Request Forgery
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete…
-
High 8.8
Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX …
-
Medium 6.3
Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes…
-
Medium 6.4
Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.
-
High 8.0
Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Fl…
-
Medium 6.7
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary…
-
Medium 6.7
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble…
-
Medium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dash…
-
Critical 9.8
MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.
-
Critical 9.8
MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.
-
Critical 9.8
MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.
-
Medium 6.5
"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authen…
-
Medium 4.3
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.…
-
Medium 5.4
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
High 7.8
"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on t…
-
Medium 4.3
Improper access to debug panel in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI…
-
High 7.4CVE-2022-39323 EPSS 37%
SQL Injection on REST API in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token.…
-
Medium 4.5
Cross-Site Scripting (XSS) through public RSS feed in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicio…
-
Critical 9.8
NODE_ENV in Keystone defaults to development with esbuild
Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"developmen…
-
Low 2.6
Improper input validation on emails links in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` li…
-
Medium 4.7
user session persists even after permanently deleting account in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as…
-
Medium 5.2
Stored Cross-Site Scripting (XSS) on login page in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be u…
-
Medium 4.9
Stored Cross-Site Scripting (XSS) in entity name in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This iss…
-
Medium 4.5
Cross-Site Scripting (XSS) in external links in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be …
-
Low 3.5
Stored Cross-Site Scripting (XSS) in user information in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account i…
-
Low 3.5
Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subje…
-
High 7.5
Stored Cross-Site Scripting (XSS) through asset inventory in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are no…
-
Critical 9.1
Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote u…
-
Medium 5.3
IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292.
-
Medium 5.9
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to condu…
-
High 7.5CVE-2022-32287 Public exploit
Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives
A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA…
-
High 8.8
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to ex…
-
Medium 5.4
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Medium 5.5
Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts t…
-
Medium 6.5
"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an au…
-
Medium 6.5
"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run …