Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Critical 10.0CVE-2023-23924 Public exploit
URI validation failure on SVG parsing in Dompdf
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…
-
High —
Warp vulnerable to Path Traversal via Improper validation of Windows paths
Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potential…
-
High 7.8
Stack Buffer Overflow in editorconfig-core-c
A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by boun…
-
Low 3.5
SiteFusion Application Server Extension getextension.php path traversal
A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to …
-
Critical 9.8
Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
-
Unscored —
Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
-
Critical 9.8
Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
-
Medium 6.5
Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, th…
-
High 8.8
Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicio…
-
Medium 5.5
Path traversal in yaffshiv
A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory. This issue affects yaffshiv up to version 0.1 included, which is the…
-
Medium 5.5
Path traversal in jefferson
A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.
-
High 8.8
Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. Th…
-
Medium 5.5
Path Traversal in ubi_reader
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is …
-
Medium 5.4
jSuites subect to Cross-site Scripting
Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.
-
High 7.4
nemo-appium vulnerable to OS Command Injection
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of…
-
Medium 5.3
http-cache-semantics vulnerable to Regular Expression Denial of Service
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
-
High 7.6
Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.
-
Medium 5.9
Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.
-
Medium 5.3
Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for Redfish & API
-
High 7.5
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via s…
-
High 8.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.ph…
-
Critical 9.8
Dromara hutool vulnerable to SQL Injection
SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
-
Critical 9.8
Dromara Hutool Deserialization of Untrusted Data vulnerability
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
-
Critical 9.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/…
-
Critical 9.8
Thinking Software Technology Co., Ltd. Efence - SQL Injection
Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
-
Critical 9.1
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server…
-
High 7.5
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information…
-
High 7.5
ChangingTec MegaServiSignAdapter - Path Traversal
ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
-
Medium 6.5
ChangingTec MegaServiSignAdapter - Out-of-bounds Read
ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disr…
-
Critical 9.8
ChangingTec MegaServiSignAdapter - Improper Input Validation
ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can…
-
Medium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in …
-
High 7.5
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale …
-
High 7.5
Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down…
-
High 8.8
SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in t…
-
High 8.1
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modb…
-
Critical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/r…
-
Medium 6.1
Joplin Desktop App vulnerable to Cross-site Scripting
Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
-
Medium 6.8
SailPoint IdentityIQ Access Control Bypass
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authen…
-
High 7.8
Buffer overflow vulnerability in function json_parse_object in sheredom json.h before commit 0825301a07cbf51653882bf2b1…
-
Critical 9.8CVE-2022-45297 Public exploit
EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.