Archive
16 November 2022
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 4.0
IBM Sterling Partner Engagement Manager information disclosure
IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.
-
Medium 6.4
The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malic…
-
Medium 5.5
Heap buffer overflow in urbdrc channel
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based clien…
-
Medium 4.8
Out of bound read in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely r…
-
Medium 4.6
Out of bounds read in zgfx decoder in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. T…
-
Medium 4.8
Division by zero in urbdrc channel in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in …
-
Medium 4.9
SSRF vulnerability in KubeVela VelaUX APIServer
KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a …
-
Medium 4.6
Missing length validation in urbdrc channel in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the serv…
-
Medium 4.3
Hospital Management Center appointment.php cross-site request forgery
A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appointment.php. The manipulation leads to cross-site request forgery. The attack can be launched remotel…
-
Medium 4.7
Sports Club Management System make_payments.php sql injection
A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate …
-
Medium 6.5
Simple History Plugin Header neutralization for logs
A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. T…
-
Medium 4.3
FeehiCMS Post My Comment Tab cross-site request forgery
A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remot…
-
Medium 6.1
Missing Authentication for Critical Function in ikus060/rdiffweb
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
-
Medium 6.3
Hospital Management Center patient-info.php sql injection
A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipulation of the argument pt_id leads to sql injection. It is possible to launch the attack remotely. The…
-
Medium 5.4
Cross-site Scripting in Zenario
Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.
-
Medium 5.3
An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the …
-
Medium 5.4
Cross-site Scripting in Zenario
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
-
Medium 5.4
Cross-site Scripting in Zenario
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.
-
Medium 5.4
Cross-site Scripting in Zenario
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.
-
Medium 6.5
An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retr…
-
Medium 6.1
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, th…
-
Medium 4.6
Missing input length validation in `drive` channel in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. T…
-
Medium 5.4
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows D…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attacke…