Archive
18 January 2023
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
High 7.8
Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which…
-
High 7.0
A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known mali…
-
Medium 4.3
Rapid7 Velociraptor directory traversal in client ID parameter
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the coll…
-
Medium 5.5
frioux ptome sql injection
A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 26829bba67858ca0bd4ce49ad50e7ce653914276. It is recommended to apply a patch to f…
-
High 8.8
Insufficient permission check in the VQL copy() function
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writin…
-
Medium 5.9
IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID…
-
Medium 4.6
IBM Robotic Process Automation for Cloud Pak cross-site scripting
IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent…
-
Medium 4.0
IBM Robotic Process Automation for Cloud Pak insufficient permission settings
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556.
-
Unscored —
This module enables you to use the media library in custom forms without the Media Library Widget. The module does not …
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 6.3CVE-2022-20964 EPSS 31%
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 5.4CVE-2022-20966 EPSS 28%
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 4.3
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Unscored —
The Media Library module does not properly check entity access in some circumstances. This may result in users with acc…
-
Unscored —
The Media Library Block module allows you to render a media entity in a block. The module does not properly check media…
-
Unscored —
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widg…
-
Medium 5.5
AlexRed contentmap contentmap.php Load sql injection
A vulnerability was found in AlexRed contentmap. It has been rated as critical. Affected by this issue is the function Load of the file contentmap.php. The manipulation of the argument contentid leads to sql injection. The name of the patch is dd265d23ff4abac…
-
Medium 5.5
ale7714 sigeprosi sql injection
A vulnerability classified as critical has been found in ale7714 sigeprosi. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 5291886f6c992316407c376145d331169c55f25b. It is recommended to apply a patch to f…
-
Medium 5.5
iamdroppy phoenixcf articles.cfm sql injection
A vulnerability was found in iamdroppy phoenixcf. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file content/2-Community/articles.cfm. The manipulation leads to sql injection. The patch is named d156faf8bc…
-
Medium 5.3
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT t…
-
Medium 5.5
ridhoq soundslike songs.py get_song_relations sql injection
A vulnerability was found in ridhoq soundslike. It has been classified as critical. Affected is the function get_song_relations of the file app/api/songs.py. The manipulation leads to sql injection. The patch is identified as 90bb4fb667d9253d497b619b9adaac83b…
-
Medium 6.5
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information …
-
Medium 4.3
Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthentic…
-
High 7.3
Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default pa…
-
Medium 5.1
Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin pr…
-
Low 2.7
Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware…
-
Low 2.7
Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware…
-
Medium 6.1CVE-2023-0214 Public exploit
XSS in Skyhigh Security SWG
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party we…
-
Low 3.5
GENI Portal sliceresource.php no_invocation_id_error cross site scripting
A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scrip…
-
Low 3.5
GENI Portal error-text.php cross site scripting
A vulnerability was found in GENI Portal. It has been rated as problematic. Affected by this issue is some unknown functionality of the file portal/www/portal/error-text.php. The manipulation of the argument error leads to cross site scripting. The attack may…
-
Medium 5.5
danynab movify-j ReviewServiceImpl.java getByMovieId sql injection
A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name…
-
High 8.0
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 8.4
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, w…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 5.5
lierdakil click-reminder BaseAction.php db_query sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the function db_query of the file src/backend/include/BaseAction.php. The manipulation leads to sql injection. The identif…
-
High 7.5
Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially ex…
-
High 7.5
Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may p…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.8
Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged at…