Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Critical 9.8
Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configur…
-
High 7.5
Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certa…
-
High —
symfont/process typosquatting malware spoofs symfony/process
In September 2021, security researchers discovered a malicious Composer package called `symfont/process`, a typosquat targeting users of `symfony/process`. The malicious package has since been removed from Packagist.
-
Medium 6.1
Security bug in ConvertToSinglePlane when used with untrusted content from the DDS loader
### Impact A memory overwrite bug was reported by a security researcher in the **ConvertToSinglePlane** method via the *texconv* command-line tool when given an invalid height for planar video textures such as NV12. This can be a potential security bug for an…
-
Medium 5.5
SourceCodester Online Tours & Travels Management System Parameter forget_password.php sql injection
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file user/forget_password.php of the component Parameter Handler. The manipulation of the argu…
-
Medium 5.5
SourceCodester Online Tours & Travels Management System Parameter forget_password.php sql injection
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/forget_password.php of the component Parameter Handler. The manipulation of the a…
-
Low 3.5
isoftforce Dreamer CMS cross site scripting
A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed t…
-
Critical 10.0
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle t…
-
High 8.8
Improper session handling of "Remember me for 7 days" functionality
Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" …
-
Medium 6.5
Discourse subject to Allocation of Resources Without Limits or Throttling
Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in …
-
High 8.8
Discourse vulnerable to Cross-site Scripting in local oneboxes
Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cros…
-
High 8.6
argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applicat…
-
Medium 6.1
An issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered whe…
-
Critical 9.8
phpmyadmin contains SQL Injection vulnerability
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
-
High 7.1
Cross-site Scripting (XSS) - Stored in modoboa/modoboa
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 7.1
Cross-site Scripting (XSS) - Stored in modoboa/modoboa
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
-
High 7.4
Improper Certificate Validation in pyload/pyload
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
-
Medium 5.3CVE-2023-0493 Public exploit
Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
-
High 7.6CVE-2023-0455 Public exploit
Unrestricted Upload of File with Dangerous Type in unilogies/bumsys
Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
-
Critical 9.6
Cross-site Scripting (XSS) - Stored in pyload/pyload
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/add_white_node.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/fromSetWirelessRepeat.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c.
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5,…
-
Critical 9.8
An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /adm…
-
Critical 9.8
Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
-
High 7.8CVE-2022-45770 Public exploit
Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escala…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 router…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 router…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link …
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link …
-
High 7.8
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
-
Critical 9.8
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
-
High 7.8
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. U…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. U…