Archive
1 February 2023
Vulnerabilities first published on this day (UTC), newest first.
41 results · Clear filters · Feed
-
Medium 6.1
Rapid7 Metasploit Pro Stored XSS
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code i…
-
Medium 5.3
Rapid7 Nexpose Certificate Validation Issue
Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or i…
-
Medium 4.3
[20230102] - Core - Missing ACL checks for com_actionlogs
An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.
-
Medium 6.3
[20230101] - Core - CSRF within post-installation messages
An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.
-
Medium 6.5
Kraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level p…
-
Medium 4.0
IBM Cloud Pak for Business Automation information disclosure
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: …
-
Medium 6.1
BIG-IP APM virtual server vulnerability
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows a…
-
Medium 4.9
iControl REST and tmsh vulnerability
In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST…
-
Medium 5.9
BIG-IP HTTP profile vulnerability
In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to t…
-
Medium 6.5
BIG-IP Edge Client for Windows vulnerability
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the ex…
-
Medium 5.4
IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…
-
Medium 5.3
IBM App Connect Enterprise Certified Container information disclosure
IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak hash of an API Key in the configuration. IBM X-Force ID: 241583.
-
Medium 5.9CVE-2023-0400 Public exploit
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local use…
-
Medium 6.5
Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthent…
-
Medium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileg…
-
Medium 5.4
Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote …
-
Medium 6.1
Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 compon…
-
Medium 5.4
Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user co…
-
Medium 6.3
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network att…
-
Medium 6.7
Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access loca…
-
Medium 6.6
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System I…
-
Medium 5.9
reason-jose ignores signature checks
reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications us…
-
Medium 6.5
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Medium 6.3
Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 5.4
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
-
Medium 6.1
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is tha…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets …
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a n…
-
Medium 6.5
lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
-
Medium 6.1CVE-2023-23074 EPSS 84%
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language …
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing t…
-
Medium 4.6
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB de…
-
Medium 5.0
A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102…
-
Medium 5.5CVE-2022-31902 Public exploit
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
-
Medium 4.9
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
-
Medium 6.1CVE-2022-46934 Scanner template
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /contro…
-
Medium 6.5
An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the d…
-
Medium 6.5
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to…
-
Medium 5.3
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to …