Archive
3 January 2023
Vulnerabilities first published on this day (UTC), newest first.
94 results · Feed
-
Low 3.5
sumocoders FrameworkUserBundle login.html.twig information exposure
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulat…
-
Low 3.5
ahmyi RivetTracker css.php changeColor cross site scripting
A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be lau…
-
Critical 10.0CVE-2022-43931 EPSS 17%
Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4…
-
High 7.5
aEnrich a+HRD - Path Traversal
aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
-
Critical 9.8
aEnrich a+HRD - SQL Injection
aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.
-
Critical 9.8
aEnrich a+HRD - Improper Authentication
aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service.
-
Critical 9.8
aEnrich a+HRD - Server-Side Request Forgery (SSRF)
aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s) request to launch Server-Side Request Forgery (SSRF) attack, to perform arbitrary system command o…
-
High 8.6
Gravitee API Management contains Path Traversal
Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
-
High 8.1CVE-2022-38766 Public exploit
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for …
-
Critical 9.8CVE-2022-38627 Scanner template
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered…
-
Critical 9.8
In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of…
-
Medium 6.7
In meta wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.7
In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
Medium 6.7
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
High 7.8
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 4.1
In vow, there is a possible information disclosure due to a race condition. This could lead to local information disclo…
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Medium 6.7
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escal…
-
Medium 6.7
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escal…
-
Medium 6.7
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
High 8.8
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote es…
-
Medium 6.7
In hevc decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escala…
-
Medium 6.7
In meta wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation…
-
Medium 6.4
In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w…
-
Medium 6.4
In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privile…
-
Medium 6.7
In ccu, there is a possible out of bounds write due to improper input validation. This could lead to local escalation o…
-
Medium 6.7
In mdp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of…
-
Medium 6.7
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escal…
-
Medium 6.4
In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.7
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
Medium 6.7
In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with…
-
Medium 4.4
In watchdog, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In gpu drm, there is a possible stack overflow due to a missing bounds check. This could lead to local escalation of pr…
-
High 8.1
SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on path…
-
Medium 6.1
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to byp…
-
High 7.8
Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker…
-
Medium 6.5
ChangingTec ServiSign - Path Traversal
ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass authentication and access arbitrary system files.
-
High 8.8
ChangingTec ServiSign - Command Injection
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allo…
-
High 8.8
ChangingTec ServiSign - Path Traversal
ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers the …
-
Medium 6.5
Galaxy Software Services Corporation. Vitals ESP - Arbitrary Path File Reading
Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary system files.