Archive
25 January 2023
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 5.9
IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditio…
-
Medium 6.2
glpi contains XSS Stored inside Standard Interface Help Link href attribute
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.
-
Medium 6.8
glpi subject to Cross-site Scripting (XSS) - Reflected
GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, t…
-
Medium 6.2
glpi contains XSS in RSS Description Link
GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links.…
-
Medium 6.2
glpi vulnerable to XSS on external links
GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.
-
Medium 6.5
glpi vulnerable to Unauthorized access to data export
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which us…
-
Medium 5.4
xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Op…
-
Medium 5.4
Cross-site Scripting (XSS) in serve-lite
All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or ou…
-
Medium 5.3CVE-2022-25927 Public exploit
ReDoS Vulnerability in ua-parser-js version
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
-
Medium 6.3
github.com/openshift/apiserver-library-go Improper Input Validation vulnerability
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used i…
-
Medium 5.5
A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Li…
-
Medium 4.7
A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Ke…
-
Medium 6.5
A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied inpu…
-
Medium 5.7
A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returni…
-
Medium 6.5
A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-ac…
-
Medium 6.5
bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_c…
-
Medium 6.7CVE-2022-29844 EPSS 36%
Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities…
-
Medium 6.2
Western Digital My Cloud OS 5 devices Command Injection Vulnerability
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.
-
Medium 5.3
VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect se…
-
Medium 6.1
phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.
-
Medium 6.1
Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrar…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute a…
-
Medium 6.1CVE-2022-47052 Public exploit
The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can …
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbi…