Archive
November 2022
Vulnerabilities first published in this month (UTC), newest first.
900 results · Clear filters · Feed
-
Medium 4.0
IBM CICS TX information disclosure
IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447.
-
Medium 6.5
Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier
A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.
-
Medium 5.3
IBM CICS TX information disclosure
IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 229467.
-
Medium 5.9
IBM CICS TX information disclosure
IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463.
-
Medium 6.5
Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.
-
Medium 4.3
IBM CICS TX Standard is vulnerable to allowing attackers access to an application via insecure session cookies
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to t…
-
Medium 5.1
IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be…
-
Medium 6.5CVE-2022-31630 Public exploit
OOB read due to insufficient input validation in imageloadfont()
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…
-
Medium 6.4
DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. …
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver cou…
-
Medium 6.4
DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on t…
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SM…
-
Medium 6.5
Users erroneously and transparently added to private messages in Discourse
Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message topics that they should not be added to. They are not notified of this, it happens transparently in …
-
Medium 6.1
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
-
Medium 6.4
DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU …
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM …
-
Medium 6.4
Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler use…
-
Medium 4.8
Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capabi…
-
Medium 6.5
OAuth Client by DigitialPixies <= 1.1.0 - CSRF
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
-
Medium 6.1CVE-2022-3578 Scanner template
ProfileGrid < 5.1.1 - Reflected Cross-Site Scripting
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
Medium 4.6
An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs …
-
Medium 6.5
Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
-
Medium 4.8
OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability …
-
Medium 6.1CVE-2022-3484 Scanner template
WPB Show Core - Reflected Cross-Site Scripting
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
-
Medium 6.1
Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
-
Medium 4.8
WP Attachments < 5.0.5 - Admin+ Stored Cross-Site Scripting
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo…
-
Medium 6.1
Insufficient Session Expiration in ikus060/rdiffweb
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
-
Medium 4.3
reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
-
Medium 6.5
reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
-
Medium 6.4
DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have bee…
-
Medium 6.4
DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have b…
-
Medium 6.5
Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access a…
-
Medium 6.5
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module…
-
Medium 4.3
Discourse-calendar exposes members of hidden groups
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and ed…
-
Medium 6.1
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script …
-
Medium 5.5
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
-
Medium 6.5
Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to…
-
Medium 6.1
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
-
Medium 6.1
Concrete CMS vulnerable to Reflected Cross-site Scripting
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Re…