Archive
27 December 2022
Vulnerabilities first published on this day (UTC), newest first.
81 results · Feed
-
High 7.8
Rockwell Automation Studio 5000 Logix Emulate Vulnerable to a Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could po…
-
High —
SentinelOne impersonated via PyPI packages
In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when calle…
-
Low 3.5
OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting
A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserApp…
-
Low 2.6
Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting
A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation…
-
Low 3.5
OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting
A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site script…
-
Medium 4.3
dolibarr_project_timesheet Form cross-site request forgery
A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated …
-
Medium 4.3
moodle-block_sitenews block_sitenews.php get_content cross-site request forgery
A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack re…
-
Low 3.5
FreePBX arimanager Views cross site scripting
A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The atta…
-
Low 3.1
Morgawr Muon handler.clj random values
A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/muon/handler.clj. The manipulation leads to insufficiently random values. The attack can be launched…
-
Medium 5.0
ReFirm Labs binwalk Archive Extraction extractor.py symlink
A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink fol…
-
Low 2.6
cocagne pysrp _ctsrp.py calculate_x information exposure
A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version…
-
Low 3.5
Nagios NCPA tail.html cross site scripting
A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remote…
-
Low 3.5
OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting
A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrad…
-
Low 2.4
FreeBPX voicemail Settings ssettings.php cross site scripting
A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site …
-
Low 3.5
FreePBX voicemail page.voicemail.php cross site scripting
A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely…
-
Low 3.5
ytti Oxidized Web conf_search.haml cross site scripting
A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possi…
-
Low 3.5
FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting
A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgal…
-
Medium 5.3
RamseyK httpserver URI ResourceHost.cpp getResource path traversal
A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/ResourceHost.cpp of the component URI Handler. The manipulation of the argument uri leads to path travers…
-
Low 3.5
IET-OU Open Media Player timedtext.php webvtt cross site scripting
A vulnerability was found in IET-OU Open Media Player up to 1.5.0. It has been declared as problematic. This vulnerability affects the function webvtt of the file application/controllers/timedtext.php. The manipulation of the argument ttml_url leads to cross …
-
Medium 5.5
FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal
A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument d…
-
Low 3.0
email-existence index.js redos
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6…
-
Low 3.5
markdown-it html_re.js redos
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is ab…
-
High 7.6
Denial of Service in usememos/memos
Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
-
Critical 9.8
dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query.
-
High 8.8
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-…
-
Critical 9.8
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticate…
-
Medium 5.3
Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain …
-
Low 3.7
Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypa…
-
Medium 5.9
Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. A…
-
Medium 6.5
Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of …
-
High 7.5
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the …
-
Critical 9.8
https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There…
-
Low 3.7
Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing th…
-
Medium 5.3
Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall a…
-
High 7.5
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtai…
-
High 7.5
Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access interna…
-
High 7.2
Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of ad…
-
Critical 9.8
h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.
-
High 7.5
Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the …
-
Low 2.7
Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of …