Archive
1 December 2022
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Medium 4.8
Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to s…
-
Medium 5.7
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps information disclosure
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vulnerability to possibly gain information to other IBM WebSphere Automation for IBM Cloud Pak for Watso…
-
Medium 5.3
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypass
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound network connection to another system. IBM X-Force ID: 240827.
-
Medium 4.3
IBM Db2U cross-site request forgery
IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.
-
Medium 6.5
IBM Db2U cross-site respect forgery
IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.
-
Medium 5.4
IBM API Connect HOST header injection
IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various a…
-
Medium 6.1
Reflected XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability.
-
Medium 5.0
Movie Ticket Booking System editBooking.php sql injection
A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated r…
-
Medium 6.3CVE-2022-4257 EPSS 44%
C-DATA Web Management System GET Parameter jumpto.php argument injection
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argu…
-
Medium 6.3
Movie Ticket Booking System booking.php sql injection
A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has…
-
Medium 4.3
Kakao PotPlayer MID File denial of service
A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disc…
-
Medium 4.7
Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices
A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code ex…
-
Medium 4.3
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in…
-
Medium 6.8
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Soph…
-
Medium 5.4
ThinkCMF Stored Cross-Site Scripting (XSS)
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client s…
-
Medium 5.9
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
-
Medium 6.5
Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion
An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's…