Archive
17 January 2023
Vulnerabilities first published on this day (UTC), newest first.
164 results · Feed
-
Medium 5.8
Cross-site Scripting (XSS) - Reflected in lirantal/daloradius
Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
-
Medium 5.8
Cross-site Scripting (XSS) - Reflected in lirantal/daloradius
Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
-
Medium 5.3
The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on…
-
High 7.5
Triggered crash on direct RRDP access
NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml"…
-
High 7.5
A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attac…
-
High 7.6
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to …
-
Critical 9.8
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, a…
-
Medium 6.1
Reflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud pri…
-
Critical 9.8
TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerabi…
-
High 8.1
Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-P…
-
High 7.5
Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.
-
High 7.8
CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a spec…
-
Medium 6.1
pgAdmin 4 Open Redirect vulnerability
Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
-
High 7.2
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, a…
-
High 8.0
OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a netwo…
-
Critical 9.8
Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS…
-
Medium 6.5
Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a netwo…
-
Medium 5.3
m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthent…
-
Unscored —
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authe…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary…
-
Medium 5.5
In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was foun…
-
Unscored —
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to roo…
-
Medium 4.8
Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, an…
-
Medium 5.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions star…
-
Unscored —
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make im…
-
High 8.0
ruby-git has potential remote code execution vulnerability
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.
-
Critical 9.8
D-Link DIR 645A1 1.06B01_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi_mai…
-
Medium 4.4
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symb…
-
Medium 6.5
A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABP…
-
Medium 6.1
A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite.
-
High 7.5CVE-2022-40319 Public exploit
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a…
-
Critical 9.8
Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify mo…
-
High 7.1
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…
-
Medium 6.5
A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which c…
-
High 7.5
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in th…
-
High 7.5
In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an att…
-
Critical 9.8
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direc…
-
High 7.5
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vul…
-
Critical 9.8
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessib…
-
Medium 5.5
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivilege…