Archive
13 December 2022
Vulnerabilities first published on this day (UTC), newest first.
74 results · Clear filters · Feed
-
Medium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Elec…
-
Medium 6.1
Cross-Site Scripting Protection bypass in HTML Sanitizer
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanit…
-
Medium 5.5
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values t…
-
Medium 6.5
demon image annotation <= 5.0 - Improper Input Restriction Validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setti…
-
Medium 5.7
Unwanted debug tool
Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.
-
Medium 4.0
rust-vmm linux-loader vulnerable to Out-of-bounds Read
In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offsets point beyond the end of the file this could lead to Virtual Machine Monitors using the `linux-loa…
-
Medium 5.3
Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requi…
-
Medium 4.3
Tuleap MediaWiki standalone "readers" can also edit pages
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not properly verified when accessing MediaWiki standalone resources. Users with read only permissions for pag…
-
Medium 4.3
Tuleap dashboards vulnerable to Incorrect Authorization
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to…
-
Medium 6.1
In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link th…
-
Medium 6.5
SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application…
-
Medium 4.3
Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker ca…
-
Medium 5.5
m0ver bible-online Search search.java query sql injection
A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injec…
-
Medium 6.1
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered…
-
Medium 5.5
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A m…
-
Medium 5.3CVE-2022-31698 EPSS 48%
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with ne…
-
Medium 6.3
Outlook for Android Elevation of Privilege Vulnerability
Outlook for Android Elevation of Privilege Vulnerability
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote …
-
Medium 5.5
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All vers…
-
Medium 6.5
AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
-
Medium 6.1
Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_templa…
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote …
-
Medium 6.1
AeroCMS v0.0.1 is vulnerable to ClickJacking.
-
Medium 6.1
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All vers…
-
Medium 6.5
A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C …
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote…
-
Medium 4.5
Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
-
Medium 5.3
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All vers…
-
Medium 4.9
AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.
-
Medium 4.8
AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerabilit…
-
Medium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote…
-
Medium 5.4
A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host …
-
Medium 6.5
Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker…
-
Medium 5.7
Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device c…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP request. The exploit can be triggered remotely by an attacker.
-
Medium 5.3
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All v…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web script…
-
Medium 5.5
Windows Bluetooth Driver Information Disclosure Vulnerability
Windows Bluetooth Driver Information Disclosure Vulnerability
-
Medium 5.4
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All …
-
Medium 6.1
A vulnerability has been identified in PLM Help Server V4.2 (All versions). A reflected cross-site scripting (XSS) vuln…