Skip to content
OpenAdvisories

Archive

16 January 2023

Vulnerabilities first published on this day (UTC), newest first.

← December 2022 2023 / January /16 February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

54 results · Clear filters · Feed

  • Medium 6.3
    CVE-2022-4890

    abhilash1985 PredictApp Cookie new_framework_defaults_7_0.rb deserialization

    A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to d…

    abhilash1985 PredictApp
  • Medium 5.5
    CVE-2021-4313

    NethServer phonenehome index.php get_country_coor sql injection

    A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d49…

    NethServer phonenehome
  • Medium 5.5
    CVE-2018-25076

    Events Extension events.php searchResults sql injection

    A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFeaturedEventByDate/getUpcomingFeaturedEventsInCategoriesWithSubcategories/recacheEvent/searchResults of the file classes/…

  • Medium 5.5
    CVE-2015-10053

    prodigasistemas curupira passwords_controller.rb sql injection

    A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is…

    prodigasistemas curupira curupira RubyGems
  • Medium 5.5
    CVE-2013-10012

    antonbolling clan7ups Login/Session sql injection

    A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c488291033958d845830ba0a1710764. …

    antonbolling clan7ups
  • Medium 5.5
    CVE-2016-15020

    liftkit database Query.php processOrderBy sql injection

    A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address t…

    liftkit database liftkit/database Packagist
  • Medium 5.4
    CVE-2022-41703

    Apache Superset: SQL injection vulnerability in adhoc clauses

    A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2022-45438

    Apache Superset: Dashboard metadata information leak

    When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prio…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.4
    CVE-2022-43721

    Apache Superset: Open Redirect Vulnerability

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.4
    CVE-2022-43720

    Apache Superset: Improper rendering of user input

    An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Supers…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.4
    CVE-2022-43718

    Apache Superset: Cross-Site Scripting vulnerability on upload forms

    Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and versi…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.4
    CVE-2022-43717

    Apache Superset: Cross-Site Scripting on dashboards

    Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and p…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.1
    CVE-2023-0323

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-0316

    Path Traversal: '\..\filename' in froxlor/froxlor

    Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.

    froxlor froxlor/froxlor froxlor/froxlor Packagist