Archive
10 January 2023
Vulnerabilities first published on this day (UTC), newest first.
73 results · Clear filters · Feed
-
Medium —
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
### Impact Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurif…
-
Medium 5.3
Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a…
-
Medium 6.5
Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, p…
-
Medium 6.5
Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the …
-
Medium 5.7
TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of int…
-
Medium 5.3
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of gues…
-
Medium 5.3
The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of …
-
Medium 5.5
Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted…
-
Medium 5.5
Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the AS…
-
Medium 6.1
Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memor…
-
Medium 5.5
A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting …
-
Medium 5.5
Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential inform…
-
Medium 6.5
Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in com…
-
Medium 4.4
Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity…
-
Medium 5.5
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers …
-
Medium 5.5
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the conte…
-
Medium 4.4
Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity fo…
-
Medium 4.7
A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the …
-
Medium 5.8
Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached da…
-
Medium 5.5
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an …
-
Medium 5.5
CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible …
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated att…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level per…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 6.1
Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting
The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the '…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level …
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.5
mapoor voteapp app.py show_refresh sql injection
A vulnerability was found in mapoor voteapp. It has been rated as critical. Affected by this issue is the function create_poll/do_poll/show_poll/show_refresh of the file app.py. The manipulation leads to sql injection. The patch is identified as b290c21a0d8bc…
-
Medium 5.5
fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading …
-
Medium 4.6
Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on…
-
Medium 5.3
Avira Security for Windows - Denial of Service
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78
-
Medium 4.5
Information Disclosure in SAP Bank Account Management (Manage Banks)
In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the appl…
-
Medium 4.6
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)
In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intellige…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulner…
-
Medium 6.4
Local Privilege Escalation in SAP Host Agent (Windows)
In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SA…