Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
1,043 results · Clear filters · Feed
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /…
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IM…
-
Medium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to…
-
Medium 5.3
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA…
-
Medium 5.3
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month v…
-
Medium 6.5
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by aut…
-
Medium 6.1CVE-2021-30134 Scanner template
php-mod/curl allows Cross-site Scripting
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by …
-
Medium 5.4
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stor…
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API public…
-
Medium 5.5
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, O…
-
Medium 6.5
In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configu…
-
Medium 6.5
Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forc…
-
Medium 5.3CVE-2019-19030 Public exploit
Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
Medium 5.3
Hashicorp Nomad Information Exposure Through Environmental Variables
HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.
-
Medium 4.3
styler_praat_scripts Slash file_segmenter.praat denial of service
A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch th…
-
Medium 4.3
docconv XMLToText memory allocation
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated rem…
-
Medium 6.3
Starcounter-Jack JSON-Patch prototype pollution
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution…
-
Medium 6.3
hughsk flat index.js unflatten prototype pollution
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollutio…
-
Medium 4.3
SourceCodester Blood Bank Management System User Registration cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name lea…
-
Medium 6.3
barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injection
A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to s…
-
Medium 5.5
FreePBX cdr Cdr.class.php ajaxHandler sql injection
A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is abl…
-
Medium 5.5
cronvel tree-kit prototype pollution
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0…
-
Medium 5.5
SimbCo httpster server.coffee fs.realpathSync path traversal
A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.…
-
Medium 5.5
Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversal
A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path t…
-
Medium 5.5
Macaron i18n i18n.go redirect
A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version …
-
Medium 6.5
GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
-
Medium 5.4
In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Sear…
-
Medium 6.5
Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source cod…
-
Medium 6.1
In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filte…
-
Medium 5.4
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
-
Medium 6.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able t…
-
Medium 5.4
An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferante…
-
Medium 5.3
Snipe-IT allows attackers to check whether a user account exists
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
-
Medium 6.5
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs,…
-
Medium 4.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affe…
-
Medium 5.5
Modern Tribe Panel Builder Plugin SearchFilter.php add_post_content_filtered_to_search_sql sql injection
A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible t…