Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
199 results · Clear filters · Feed
-
Low 2.3
In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a mis…
-
Low 3.5
rAthena FluxCP Service Desk Image URL view.php cross site scripting
A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads …
-
Low 3.5
Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page.
-
Low 2.6
yikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scripting
A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_t…
-
Low 3.5
zbl1996 FS-Blog Title cross site scripting
A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Title Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identif…
-
Low 3.5
pallidlight online-course-selection-system cross site scripting
A vulnerability was found in pallidlight online-course-selection-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of th…
-
Low 3.5
RDFlib pyrdfa3 __init__.py _get_option cross site scripting
A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch …
-
Low 3.5
S-CMS Contact Information Page cross site scripting
A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site …
-
Low 3.5
Authorization header displayed in the debug logs
Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials …
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was p…
-
Low 2.4
annyshow DuxCMS Article edit cross site scripting
A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross s…
-
Low 3.9
Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data…
-
Low 2.3
Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to acces…
-
Low 3.3
Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attack…
-
Low 3.3
Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android…
-
Low 3.3
Buildah (as part of Podman) vulnerable to Path Traversal
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
-
Low 3.5
xiandafu beetl-bbs WebUtils.java cross site scripting
A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be …
-
Low 3.5
Mingsoft MCMS search.do cross site scripting
A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack re…
-
Low 3.5
y_project RuoYi-Cloud JSON cross site scripting
A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The …
-
Low 3.5
LinZhaoguan pb-cms IpUtil.getIpAddr cross site scripting
A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this vulnerability is the function IpUtil.getIpAddr. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been …
-
Low 3.5
csliuwy coder-chain_gdut cross site scripting
A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /back/index.php/user/User/?1. The manipulation leads to cross site scripting. The attack can be la…
-
Low 3.4
Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may all…
-
Low 3.6
An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.…
-
Low 3.8
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.…
-
Low 3.3
Information Exposure Vulnerability in JP1/Automatic Operation
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09…
-
Low 3.3
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Low 3.3
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Low 3.3
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Low 3.5
SourceCodester Human Resource Management System employeeview.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is po…
-
Low 2.0
Incorrect privilege assignment in M-Files Web Server
Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.
-
Low 2.6
Nextcloud Server's disabled download shares still allow download through preview images
Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without be…
-
Low 2.4
Nextcloud Server has no password length limit when creating a user as an administrator
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Vers…
-
Low 3.5
Nextcloud Server's calendar name length not validated before writing to database
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 2…
-
Low 3.5
Movie Ticket Booking System booking.php cross site scripting
A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file booking.php. The manipulation of the argument id leads to cross site scripting. The attack can …
-
Low 3.5
SourceCodester Canteen Management System customer.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_echo of the file customer.php. The manipulation leads to cross site scripting. The attack can be initia…
-
Low 3.5
Movie Ticket Booking System POST Request cross site scripting
A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request Handler. The manipulation of the argument ORDER_ID leads to cross site scripting. It is possible to l…
-
Low 3.5
SourceCodester Canteen Management System categories.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the file categories.php. The manipulation leads to cross site scripting. It is possible to initiate the att…
-
Low 2.4
Movie Ticket Booking System editBooking.php cross site scripting
A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBooking.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The …
-
Low 2.7
A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database conte…