Archive
25 December 2022
Vulnerabilities first published on this day (UTC), newest first.
45 results · Feed
-
Medium 4.3
styler_praat_scripts Slash file_segmenter.praat denial of service
A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch th…
-
Medium 4.3
docconv XMLToText memory allocation
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated rem…
-
Medium 6.3
Starcounter-Jack JSON-Patch prototype pollution
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution…
-
Medium 6.3
hughsk flat index.js unflatten prototype pollution
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollutio…
-
Low 3.5
kkFileView picturesPreview setWatermarkAttribute cross site scripting
A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely.…
-
High 7.3
SourceCodester School Dormitory Management System Admin Login sql injection
A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation leads to sql injection. The attack can be laun…
-
Medium 4.3
SourceCodester Blood Bank Management System User Registration cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name lea…
-
High 7.3
SourceCodester Blood Bank Management System login.php sql injection
A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attac…
-
Medium 6.3
barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injection
A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to s…
-
Medium 5.5
FreePBX cdr Cdr.class.php ajaxHandler sql injection
A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is abl…
-
Low 3.5
Venganzas del Pasado cross site scripting
A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of t…
-
Low 3.5
Hide Files on GitHub options.js addEventListener cross site scripting
A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the file extension/options.js. The manipulation leads to cross site scripting. The attack may be initia…
-
Low 3.5
asrashley dash-live DOM Node media.js ready cross site scripting
A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initi…
-
Medium 5.5
cronvel tree-kit prototype pollution
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0…
-
Low 2.4
myapnea Title cross site scripting
A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to…
-
Low 2.6
fredsmith utils Filename screenshot_sync predictable state
A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The…
-
Medium 5.5
SimbCo httpster server.coffee fs.realpathSync path traversal
A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.…
-
Medium 5.5
Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversal
A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path t…
-
Medium 5.5
Macaron i18n i18n.go redirect
A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version …
-
High 8.1
Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
-
Critical 9.1
Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Up…
-
Medium 6.5
GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
-
Medium 5.4
In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Sear…
-
Medium 6.5
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source cod…
-
High 8.8
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user…
-
High 7.5
Slixmpp lacks SSL Certificate hostname validation in XMLStream
Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
-
Medium 6.1
In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filte…
-
Critical 9.8
Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Up…
-
High 7.2
Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records…
-
High 8.8CVE-2022-40005 EPSS 35%
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by th…
-
Critical 9.8
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating…
-
Critical 9.1
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authen…
-
High 7.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can …
-
Medium 5.4
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
-
High 7.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web…
-
Medium 6.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able t…
-
Medium 5.4
An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferante…
-
Medium 5.3
Snipe-IT allows attackers to check whether a user account exists
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
-
Critical 9.8
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec us…
-
Medium 6.5
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs,…