Archive
4 January 2023
Vulnerabilities first published on this day (UTC), newest first.
54 results · Clear filters · Feed
-
Medium 5.4
Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe
Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the applic…
-
Medium 6.3
ghostlander Halcyon Block Verification main.cpp AddToBlockIndex access control
A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access co…
-
Medium 6.1
Reflected POST XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability.
-
Medium 6.1
Reflected XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability.
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition information disclosure
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. IBM X-Force ID: 219507.
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition SQL injection
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end datab…
-
Medium 5.5
IBM Sterling B2B Integrator Standard Edition session fixation
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195.
-
Medium 5.4
IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only tru…
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition privilege escalation
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter. IBM X-Force ID: 241362.
-
Medium 6.1
IBM Sterling B2B Integrator cross-site scripting
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden…
-
Medium 5.4
IBM Sterling B2B Integrator Standard Edition cross-site scripting
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden…
-
Medium 5.0
Arbitrary HTML injection in discourse-mermaid-theme-component
Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary …
-
Medium 5.4
ViewVC XSS vulnerability in revision view changed path "copyfrom" locations
ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges t…
-
Medium 4.3
AlliedModders AMX Mod X Console Command adminvote.sma cmdVoteMap path traversal
A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument am…
-
Medium 5.5
gesellix titlelink plugin_content_title.php sql injection
A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is nam…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 5.5
In sprd_sysdump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 5.5
In sprd_sysdump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local…
-
Medium 6.7
In network service, there is a missing permission check. This could lead to local escalation of privilege with System e…
-
Medium 5.5
In contacts service, there is a missing permission check. This could lead to local denial of service in Contacts servic…
-
Medium 5.5
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts servic…
-
Medium 5.5
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts servic…
-
Medium 5.5
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts servic…
-
Medium 5.5
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts servic…
-
Medium 5.5
NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.
-
Medium 5.5
In music service, there is a missing permission check. This could lead to local denial of service in contacts service w…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…