Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Medium 5.5
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.4
Weak Password Requirements in froxlor/froxlor
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.4
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billi…
-
High 7.3
JSZip contains Path Traversal via loadAsync
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
-
Medium 5.3
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be ab…
-
Medium 5.5
NYUCCL psiTurk experiment.py special elements used in a template engine
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used…
-
Low 3.5
PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site …
-
High 7.3
PHPGurukul Bank Locker Management System Login index.php sql injection
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql…
-
Medium 6.3
SourceCodester Online Tours & Travels Management System s.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to…
-
Medium 4.7
SourceCodester Online Tours & Travels Management System practice_pdf.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql i…
-
Medium 6.3
Metabase subject to Improper Privilege Management
Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with gre…
-
Medium 5.7
Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. Ho…
-
Medium 6.1
Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element
Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitra…
-
Medium 4.3
Discourse's exclude_tags param could leak which topics had a specific hidden tag
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, someone can use the `exclude_tag param` to filter out topics and deduce which ones were using a s…
-
High 8.6
Discourse vulnerable to ReDoS in user agent parsing
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user …
-
Medium 4.9
OpenMage LTS has DoS vulnerability in MaliciousCode filter
OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
High 8.8
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrar…
-
Medium 6.5
wire-server vulnerable to unauthorized removal of Bots from Conversations
wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins sho…
-
High 7.3
Grafana stored XSS in FileUploader component
Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possib…
-
Medium 6.7
Grafana vulnerable to spoofing originalUrl of snapshots
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user ope…
-
High 8.2
ContentStudio <= 1.2.5 - Authorization Bypass
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions…
-
High 7.5
ContentStudio <= 1.2.5 - Information Exposure
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
-
Critical 9.8
ContentStudio <= 1.2.5 - Missing Authorization
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via …
-
Medium 5.3
wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering
Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML repr…
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Missing Authorization
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permi…
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers …
-
Medium 4.4
Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided…
-
Low 3.5
YAFNET Private Message PostPrivateMessage cross site scripting
A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/me…
-
High 7.2
OpenMage LTS DataFlow upload remote code execution vulnerability
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 c…
-
High 8.8
OpenMage LTS authenticated remote code execution through layout update
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
-
High 7.2
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
-
High 7.2
OpenMage LTS arbitrary command execution in custom layout update through blocks
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
-
Medium 4.2
Magneto-lts vulnerable to Cross-Site Request Forgery
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the re…
-
Medium 4.7
SourceCodester Online Tours & Travels Management System expense_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It…
-
Medium 4.7
SourceCodester Online Tours & Travels Management System expense_report.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_…
-
Medium 4.7
SourceCodester Online Tours & Travels Management System disapprove_user.php sql injection
A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql…