Archive
14 January 2023
Vulnerabilities first published on this day (UTC), newest first.
28 results · Feed
-
Medium 5.5
abreen Apollo path traversal
A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to path traversal. The patch is named 6206406630780bbd074aff34f4683fb764faba71. It is recommended to apply…
-
Medium 5.5
ssn2013 cis450Project AddAppUser.java addUser sql injection
A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the …
-
Low 3.5
Minichan reports.php cross site scripting
A vulnerability, which was classified as problematic, was found in Minichan. This affects an unknown part of the file reports.php. The manipulation of the argument headline leads to cross site scripting. It is possible to initiate the attack remotely. The ide…
-
Medium 4.3
WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control
Broken Access Control in Betheme theme <= 26.6.1 on WordPress.
-
Medium 6.1CVE-2022-38467 Scanner template
WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
-
High 7.5
Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro …
-
Medium 6.5
Netdata is vulnerable to improper authentication
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across r…
-
High 8.1
Netdata vulnerable to command injection
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the functi…
-
Critical 9.8
Izanami is vulnerable to Authorization Bypass
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the aut…
-
Medium 6.5
Autolab is vulnerable to file disclosure via remote handin feature
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovere…
-
Low 3.5
Nextcloud Deck vulnerable to authorization bypass
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recomme…
-
Low 3.5
Nextcloud Deck vulnerable to uncontrolled resource consumption
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated potentially causing a DoS when performed multiple times. There are currently no known…
-
High 7.1
neo4j-apoc-procedures is vulnerable to path traversal
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious a…
-
High 7.3CVE-2023-22478 Scanner template
KubePi is vulnerable to missing authorization
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
-
High 8.8
Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was dis…
-
High 7.3
KubeOperator is vulnerable to unauthorized access to system API
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive informati…
-
Medium 6.5
Incorrect Authorization in firefly-iii/firefly-iii
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
-
Low 3.5
Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io
Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.
-
Critical 9.8
Code Injection in pyload/pyload
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in alfio-event/alf.io
Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.
-
High 8.4
Improper Input Validation in publify/publify
Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.
-
Medium 6.5
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not t…
-
High 7.2
Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an uns…
-
Medium 6.5
Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.
-
High 8.8
Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of a…
-
High 8.8
Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection beca…
-
High 7.6CVE-2022-1812 EPSS 31%
Integer Overflow or Wraparound in publify/publify
Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
-
Medium 4.6
Insecure Storage of Sensitive Information in publify/publify
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.