Archive
1 February 2023
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
High 7.5
Apache InLong: Jdbc Connection causes arbitrary file reading in InLong
Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 h…
-
High 8.2
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker coul…
-
Medium 6.5
Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthent…
-
High 7.5
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potential…
-
High 7.0
Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A loca…
-
High 7.5
Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploi…
-
Medium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileg…
-
Medium 5.4
Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote …
-
High 8.1
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unaut…
-
High 7.8
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged lo…
-
Medium 6.1
Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 compon…
-
High 7.4
is-http2 vulnerable to Improper Input Validation
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.
-
High 7.4
mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.
-
Medium 5.4
Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user co…
-
Medium 6.3
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network att…
-
Medium 6.7
Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access loca…
-
High 7.3
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS.…
-
Medium 6.6
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System I…
-
High 7.8
Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of crypt…
-
High 7.1
Dell BIOS contains a heap buffer overflow vulnerability. A local attacker with admin privileges could potentially explo…
-
High 7.8
Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Loca…
-
Medium 5.9
reason-jose ignores signature checks
reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications us…
-
High 8.6
Cross-site (XSS) vulnerability with Express API in Eta
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied thing…
-
Medium 6.5
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Medium 6.3
Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
-
High 7.2
Cross-site Scripting (XSS) - Stored in projectsend/projectsend
Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
-
High 8.1
OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. T…
-
Critical 9.1CVE-2023-0587 EPSS 60%
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length head…
-
Critical 9.3
Cross-site Scripting (XSS) - Reflected in ampache/ampache
Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.
-
High 8.8
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This c…
-
Medium 5.4
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
High 8.8CVE-2023-24610 Public exploit
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. Th…
-
Critical 9.8CVE-2023-23076 EPSS 74%
OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
-
High 7.5
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.
-
High 7.2
An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a craft…
-
Unscored —
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate user…
-
Medium 6.1
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is tha…
-
Unscored —
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartex…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets …