Archive
20 December 2022
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Medium 5.1
IBM Spectrum Control information disclosure
IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 233982.
-
Medium 4.4
IBM Security Guardium information disclosure
IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 238641.
-
Medium 5.0
ghinstallation returns app JWT in error responses
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be r…
-
Medium 4.6
IBM UrbanCode Deploy (UCD) cross-site scripting
IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
-
Medium 6.5
PJSIP vulnerable to heap buffer overflow when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown att…
-
Medium 6.2
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of service
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these authorizations. IBM X-Force ID: 240034.
-
Medium 5.3
IBM Financial Transaction Manager information disclosure
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. event log entries) about the FTM SWIFT system. IBM X-Force ID: 239708.
-
Medium 5.5
Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible fo…
-
Medium 6.4
HCL BigFix WebUI is affected by a missing-permission-check vulnerability
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
-
Medium 5.3
The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause …
-
Medium 4.8
TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial o…
-
Medium 4.8
TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Den…
-
Medium 5.3
The HAware module has a function logic error. Successful exploitation of this vulnerability will affect the account rem…
-
Medium 6.5
TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading…
-
Medium 4.8
An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) vi…
-
Medium 5.5
Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypa…