Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
157 results · Clear filters · Feed
-
Low 3.5
WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy_switcher_init cross site scripting
A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site script…
-
Low 3.5
Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting
A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The at…
-
Low 3.5
snoyberg keter Proxy.hs cross site scripting
A vulnerability has been found in snoyberg keter up to 1.8.1 and classified as problematic. This vulnerability affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross site scripting. The attack can be initiated re…
-
Low 2.0
shannah Xataface Installer install_form.js.php testftp cross site scripting
A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripti…
-
Low 3.5
University of Cambridge django-ucamlookup Lookup cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to…
-
Low 3.5
OpenACS bug-tracker Search nav-bar.adp cross-site request forgery
A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack rem…
-
Low 3.5
OSM Lab show-me-the-way site.js cross site scripting
A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named…
-
Low 3.5
Evolution Events Artaxerxes POST Parameter middleware.py information disclosure
A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/middleware.py of the component POST Parameter Handler. The manipulation of the argument password lea…
-
Low 3.5
soerennb eXtplorer cross site scripting
A vulnerability has been found in soerennb eXtplorer up to 2.1.12 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to vers…
-
Low 3.5
kakwa LdapCherry URL cross site scripting
A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgradin…
-
Low 3.1
Improper Restriction of Rendered UI Layers or Frames in pyload/pyload
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
-
Low 3.5
Kaltura mwEmbed DefaultSettings.php cross site scripting
A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scriptin…
-
Low 2.4
fossology cross site scripting
A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8…
-
Low 3.5
slackero phpwcms SVG File cross site scripting
A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. …
-
Low 3.5
oxguy3 coebot-www channel.js showChannelBoir cross site scripting
A vulnerability was found in oxguy3 coebot-www and classified as problematic. This issue affects the function displayChannelCommands/displayChannelQuotes/displayChannelAutoreplies/showChannelHighlights/showChannelBoir of the file js/channel.js. The manipulati…
-
Low 3.5
innologi appointments Extension Appointment cross site scripting
A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scriptin…
-
Low 3.5
kkokko NeoXplora Trainer cross site scripting
A vulnerability, which was classified as problematic, has been found in kkokko NeoXplora. Affected by this issue is some unknown functionality of the component Trainer Handler. The manipulation leads to cross site scripting. The attack may be launched remotel…
-
Low 3.1
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
-
Low 3.5
ahmyi RivetTracker cross site scripting
A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. …
-
Low 3.5
sumocoders FrameworkUserBundle login.html.twig information exposure
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulat…
-
Low 3.5
ahmyi RivetTracker css.php changeColor cross site scripting
A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be lau…
-
Low 2.7
Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log Download
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for ex…
-
Low 3.1
OpenDNS OpenResolve API endpoints.py get cross site scripting
A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launche…
-
Low 2.6
drybjed ansible-ntp main.yml amplification
A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack c…
-
Low 3.5
Jobs-Plugin cross site scripting
A vulnerability classified as problematic was found in Jobs-Plugin. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier of the patch is b8a56718b1d4283…
-
Low 3.5
82Flex WEIPDCRM cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of …
-
Low 3.5
stiiv contact_app View.php render cross site scripting
A vulnerability has been found in stiiv contact_app and classified as problematic. Affected by this vulnerability is the function render of the file libs/View.php. The manipulation of the argument var leads to cross site scripting. The attack can be launched …
-
Low 2.4
dragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scripting
A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthread_list_threads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of t…
-
Low 3.7
enigmaX Scrambling Table main.c getSeed prng seed
A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the file main.c of the component Scrambling Table Handler. The manipulation leads to predictable seed in pseudo-random number…
-
Low 3.5
rails-cv-app uploaded_files_controller.rb path traversal
A vulnerability was found in rails-cv-app. It has been rated as problematic. Affected by this issue is some unknown functionality of the file app/controllers/uploaded_files_controller.rb. The manipulation with the input ../../../etc/passwd leads to path trave…
-
Low 3.5
kirill2485 TekNet loggedin.php cross site scripting
A vulnerability was found in kirill2485 TekNet. It has been classified as problematic. Affected is an unknown function of the file pages/loggedin.php. The manipulation of the argument statusentery leads to cross site scripting. It is possible to launch the at…
-
Low 3.5
admont28 Ingnovarq insertarSliderAjax.php cross site scripting
A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site…
-
Low 2.6
Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy
A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1. Affected by this vulnerability is the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to obse…
-
Low 3.1
SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the …
-
Low 3.5
Zenoss Dashboard defaultportlets.js cross site scripting
A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4. Affected by this vulnerability is an unknown functionality of the file ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js. The manipulation of the argument HTM…
-
Low 3.5
flar2 ElementalX ipsec xfrm_user.c xfrm_dump_policy_done denial of service
A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9. Affected is the function xfrm_dump_policy_done of the file net/xfrm/xfrm_user.c of the component ipsec. The manipulation leads to denial of service. Upgrading t…
-
Low 3.3CVE-2022-47952 Public exploit
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists,…