Archive
6 January 2023
Vulnerabilities first published on this day (UTC), newest first.
40 results · Clear filters · Feed
-
Medium 5.5
Piwigo-Guest-Book Navigation Bar guestbook.inc.php sql injection
A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql in…
-
Medium 5.5
sheilazpy eShop sql injection
A vulnerability was found in sheilazpy eShop. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is e096c5849c4dc09e1074104531014a62a5413884. It is recommended to apply a patch t…
-
Medium 5.5
JervenBolleman sparql-identifiers RegistryDao.java sql injection
A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical. This issue affects some unknown processing of the file src/main/java/org/identifiers/db/RegistryDao.java. The manipulation leads to sql injection. The patch is named 44…
-
Medium 6.3
devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file
A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileRes…
-
Medium 5.5
JoomGallery Image Sort default.php sql injection
A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation lead…
-
Medium 5.5
IBM Maximo Application Suite command injection
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.
-
Medium 4.1
IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225232.
-
Medium 5.5
himiklab yii2-jqgrid-widget JqGridAction.php addSearchOptionsRecursively sql injection
A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to ver…
-
Medium 5.5
ScottTZhang voter-js main.js sql injection
A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d804…
-
Medium 6.3
Cross-Site Scripting in Canarytoken history
Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens prior to sha-fb61290. An attacker who discovers an HTTP-based Canaryt…
-
Medium 5.5
DBRisinajumi d2files D2filesController.php actionDownloadFile sql injection
A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading…
-
Medium 5.5
typcn Blogile server.js getNav sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile. Affected is the function getNav of the file server.js. The manipulation of the argument query leads to sql injection. The name of the patch is cfec3…
-
Medium 6.3
kassi xingwall oauth.js session fixiation
A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e1408743048e29d9c099d…
-
Medium 5.5
Arthmoor QSF-Portal index.php path traversal
A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c75…
-
Medium 5.5
tbezman school-store sql injection
A vulnerability classified as critical has been found in tbezman school-store. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 2957fc97054216d3a393f1775efd01ae2b072001. It is recommended to apply a patch t…
-
Medium 4.6
Forged Alliance Forever Vote improper authorization
A vulnerability was found in Forged Alliance Forever up to 3746. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Vote Handler. The manipulation leads to improper authorization. Upgrading to version…
-
Medium 5.5
PeterMu nodebatis sql injection
A vulnerability was found in PeterMu nodebatis up to 2.1.x. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 6629…
-
Medium 5.5
trampgeek jobe LanguageTask.php run_in_sandbox command injection
A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is a…
-
Medium 5.5
HPI-Information-Systems ProLOD sql injection
A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical. This vulnerability affects unknown code. The manipulation of the argument this leads to sql injection. The name of the patch is 3f710905458d49c77530bd3cbcd8960457566b…
-
Medium 5.5
Seiji42 cub-scout-tracker databaseAccessFunctions.js sql injection
A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker. This affects an unknown part of the file databaseAccessFunctions.js. The manipulation leads to sql injection. The patch is named b4bc1a328b1f59437db159f9d136d9ed15707e3…
-
Medium 5.5
jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection
A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is…
-
Medium 5.5
e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity reference
A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation le…
-
Medium 5.5
Apache James server: Temporary File Information Disclosure
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James s…
-
Medium 5.5
Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j…
-
Medium 5.5
JATOS ZIP ZipUtil.java ZipUtil path traversal
A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha …
-
Medium 6.8
Buffer over-read in Core
Information disclosure due to buffer overread in Core
-
Medium 6.8
Buffer overread in Core
Information disclosure due to buffer overread in Core
-
Medium 5.9
Integer overflow to buffer overflow in Audio
Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
-
Medium 6.2
Use-after-Free in MODEM
Denial of service in MODEM due to improper pointer handling
-
Medium 6.0
Information Exposure in DSP Services
Information exposure in DSP services due to improper handling of freeing memory
-
Medium 6.7
Incorrect Type Conversion in Video driver
Memory corruption in video driver due to type confusion error during video playback
-
Medium 6.7
Use-After-Free Issue in Display
Memory corruption in display due to double free while allocating frame buffer memory
-
Medium 6.7
Time-of-check Time-of-use Race Condition in Multimedia Framework
Memory corruption in Multimedia Framework due to unsafe access to the data members
-
Medium 6.7
Incorrect type casting in Display driver
Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields
-
Medium 4.6
Buffer Over-read in BOOT
Denial of service while processing fastboot flash command on mmc due to buffer over read
-
Medium 5.4
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the inpu…
-
Medium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execu…
-
Medium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbi…
-
Medium 6.1CVE-2022-44870 Public exploit
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary …
-
Medium 6.5
The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerabili…