Archive
15 December 2022
Vulnerabilities first published on this day (UTC), newest first.
46 results · Clear filters · Feed
-
Medium 4.3
BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId,…
-
Medium 6.1
HCL Digital Experience is susceptible to open redirects
In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.
-
Medium 5.5
WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit…
-
Medium 5.9
Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects Book…
-
Medium 5.3
Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action w…
-
Medium 6.1
editor.js contains Code Injection
Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.
-
Medium 5.3
Helm contains Denial of service through schema file
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a…
-
Medium 5.3
Helm vulnerable to Denial of service via NULL Pointer Dereference
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, t…
-
Medium 5.3
Helm vulnerable to Denial of service through string value parsing
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, …
-
Medium 5.4
Light client verification not taking into account chain ID
Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-clien…
-
Medium 6.1
FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
-
Medium 5.3
easywebpack-cli Path Traversal vulnerability
Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request.
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows rem…
-
Medium 6.1
FeehiCMS vulnerable to Cross Site Scripting
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
-
Medium 5.3
RainyGao DocSys path traversal
A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.DocSystem.controller.UserController#getUserImg. The manipulation leads to path traversal: '../filedir…
-
Medium 6.4
Cross-site Scripting (XSS) - Generic in openemr/openemr
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.
-
Medium 5.5
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input…
-
Medium 5.3
The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.…
-
Medium 5.4
An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ve…
-
Medium 5.3
An issue existed with the file paths used to store website data. The issue was resolved by improving how website data i…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be a…
-
Medium 6.5
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.…
-
Medium 5.3
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough info…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for W…
-
Medium 6.5
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue i…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or …
-
Medium 5.4
FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
-
Medium 5.4
FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
-
Medium 5.4
FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
-
Medium 5.4
FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
-
Medium 6.1
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripti…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.…
-
Medium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Pars…
-
Medium 5.5
This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 1…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, m…
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may …
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and …