Archive
25 November 2022
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Critical 9.8
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass paramet…
-
Critical 9.8
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port paramet…
-
High 7.5
Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers …
-
High 8.8
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actio…
-
High 7.2
eyoom builder Remote Code Execution Vulnerability
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
-
Low 3.3
Nextcloud Talk Android broadcast incorrect permission handling
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk An…
-
High 8.1
ERP solution Remote Code Execution Vulnerability
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
-
High 7.8
OndiskPlayer Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
-
Critical 9.8
Badaso vulnerable to Remote Code Execution (RCE)
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
-
High 8.2
Browsershot 3.57.2 - Server Side XSS to LFR via URL
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
-
Medium 6.5
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because t…
-
High 7.3
Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been ad…
-
Low 3.3
Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permi…
-
Critical 9.0
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an au…
-
Critical 9.0
PyroCMS vulnerable to stored Cross Site Scripting
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
-
High 8.2
Browsershot 3.57.3 - Server Side XSS to LFR via HTML
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not co…
-
High 8.2
Browsershot 3.57.2 - Server Side XSS to LFR via HTML
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:/…