Archive
19 January 2023
Vulnerabilities first published on this day (UTC), newest first.
32 results · Clear filters · Feed
-
Medium 6.4
Buffer Overlow in TSS2_RC_Decode in tpm2-tss
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `lay…
-
Medium 5.4
HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
-
Medium 5.9
IBM Spectrum Virtualize information disclosure
IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.
-
Medium 4.8
WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
-
Medium 5.4
Events Made Easy <= 2.3.16 - Missing Authorization
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with s…
-
Medium 5.4
Social Warfare <= 4.3.1 - Cross-Site Request Forgery
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to …
-
Medium 5.4
Social Warfare <= 4.3.0 - Missing Authorization
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissi…
-
Medium 5.9
WAGO: Missing authentication for config export functionality in multiple products
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot fo…
-
Medium 5.5
Anant Labs google-enterprise-connector-dctm sql injection
A vulnerability has been found in Anant Labs google-enterprise-connector-dctm up to 3.2.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/domain leads to sql injection. The patc…
-
Medium 6.3
copperwall Twiddit index.php sql injection
A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc.…
-
Medium 5.5
oktora24 2moons sql injection
A vulnerability classified as critical has been found in oktora24 2moons. Affected is an unknown function. The manipulation leads to sql injection. The patch is identified as 1b09cf7672eb85b5b0c8a4de321f7a4ad87b09a7. It is recommended to apply a patch to fix …
-
Medium 5.6
bastianallgeier Kirby Webmentions Plugin injection
A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is…
-
Medium 5.5
viakondratiuk cash-machine machine.py update_failed_attempts sql injection
A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the p…
-
Medium 4.4
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to…
-
Medium 4.4
A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass acc…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN…
-
Medium 4.9
A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could …
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticat…
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWor…
-
Medium 5.5
A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remot…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.7
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. Th…
-
Medium 6.5
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share dev…
-
Medium 5.4
A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cr…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV…
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
-
Medium 6.8
Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
-
Medium 6.5CVE-2022-31901 Public exploit
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the appl…
-
Medium 5.4CVE-2022-46889 EPSS 60%
A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers t…
-
Medium 6.1CVE-2022-46888 Scanner template
Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inje…
-
Medium 4.3
Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is…