Archive
30 November 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 4.1
A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via …
-
Medium 4.7
Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that al…
-
Medium 6.5
HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
-
Medium 4.9
An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Succes…
-
Medium 4.9
An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful expl…
-
Medium 5.5
A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to co…
-
Medium 6.1
A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker…
-
Medium 5.3
Information disclosure in M-Files Server
Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.
-
Medium 5.3
WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
-
Medium 5.4
WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.
-
Medium 6.7
An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This all…
-
Medium 5.0
SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injection
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_invoice.php of the component POST Request Handler. The manipulation of the argument search leads to sq…
-
Medium 5.3
SourceCodester Book Store Management System information disclosure
A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/index.php/user/edit_user/. The manipulation of the argument password leads to information disclosure…
-
Medium 4.2
Tribal Systems Zenario CMS Remember Me session fixiation
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initi…
-
Medium 4.7
SourceCodester Event Registration System unrestricted upload
A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB…
-
Medium 6.8
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An…
-
Medium 5.4
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind c…
-
Medium 6.2
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual…
-
Medium 5.8
Code Injection
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed…
-
Medium 6.5
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device no…
-
Medium 5.4
Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out…
-
Medium 5.5
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial o…
-
Medium 4.3CVE-2022-41413 Public exploit
perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…
-
Medium 5.0
Command Injection
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1…
-
Medium 6.3
Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection
A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the file ip/syscmd.htm. The manipulation leads to os command injection. The attack may be launched remotel…
-
Medium 6.1
SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripti…