Archive
19 January 2023
Vulnerabilities first published on this day (UTC), newest first.
56 results · Feed
-
Medium 6.4
Buffer Overlow in TSS2_RC_Decode in tpm2-tss
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `lay…
-
Critical 9.8
heap-over-flow in stun_parse_attribute in sofia-sip
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. …
-
Medium 5.4
HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Medium 5.9
IBM Spectrum Virtualize information disclosure
IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.
-
Medium 4.8
WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
-
Medium 5.4
Events Made Easy <= 2.3.16 - Missing Authorization
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with s…
-
Medium 5.4
Social Warfare <= 4.3.1 - Cross-Site Request Forgery
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to …
-
Medium 5.4
Social Warfare <= 4.3.0 - Missing Authorization
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissi…
-
Medium 5.9
WAGO: Missing authentication for config export functionality in multiple products
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot fo…
-
High 7.0
Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation v…
-
Low 2.6
gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an…
-
Medium 5.5
Anant Labs google-enterprise-connector-dctm sql injection
A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patc…
-
Medium 6.3
copperwall Twiddit index.php sql injection
A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc.…
-
Medium 5.5
oktora24 2moons sql injection
A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix …
-
Low 3.5
MyCMS Visitors Module view.php build_view cross site scripting
A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting.…
-
Medium 5.6
bastianallgeier Kirby Webmentions Plugin injection
A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is…
-
Medium 5.5
viakondratiuk cash-machine machine.py update_failed_attempts sql injection
A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the p…
-
Medium 4.4
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to…
-
Medium 4.4
A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass acc…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN…
-
Medium 4.9
A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could …
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticat…
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWor…
-
Medium 5.5
A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remot…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.5
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share dev…
-
High 8.6
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unau…
-
High 8.6
A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisc…
-
High 8.8
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local …
-
Medium 5.4
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cr…
-
Critical 9.0CVE-2023-20025 Public exploit
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers c…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV…
-
None 0.0
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could…
-
High 8.1
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Un…
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.