Archive
25 December 2022
Vulnerabilities first published on this day (UTC), newest first.
21 results · Clear filters · Feed
-
Medium 4.3
styler_praat_scripts Slash file_segmenter.praat denial of service
A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch th…
-
Medium 4.3
docconv XMLToText memory allocation
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated rem…
-
Medium 6.3
Starcounter-Jack JSON-Patch prototype pollution
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution…
-
Medium 6.3
hughsk flat index.js unflatten prototype pollution
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollutio…
-
Medium 4.3
SourceCodester Blood Bank Management System User Registration cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name lea…
-
Medium 6.3
barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injection
A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to s…
-
Medium 5.5
FreePBX cdr Cdr.class.php ajaxHandler sql injection
A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is abl…
-
Medium 5.5
cronvel tree-kit prototype pollution
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0…
-
Medium 5.5
SimbCo httpster server.coffee fs.realpathSync path traversal
A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.…
-
Medium 5.5
Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversal
A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path t…
-
Medium 5.5
Macaron i18n i18n.go redirect
A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version …
-
Medium 6.5
GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
-
Medium 5.4
In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Sear…
-
Medium 6.5
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source cod…
-
Medium 6.1
In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filte…
-
Medium 5.4
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
-
Medium 6.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able t…
-
Medium 5.4
An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferante…
-
Medium 5.3
Snipe-IT allows attackers to check whether a user account exists
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
-
Medium 6.5
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs,…
-
Medium 4.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affe…