Archive
1 February 2023
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a n…
-
Medium 6.5
lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
-
High 7.5
Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when pars…
-
Unscored —
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. N…
-
High 7.5
Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.
-
High 7.5CVE-2023-23969 EPSS 47%
Django contains Uncontrolled Resource Consumption via cached header
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value o…
-
Medium 6.1CVE-2023-23074 EPSS 84%
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language …
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing t…
-
Medium 4.6
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB de…
-
High 8.8
VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the …
-
Medium 5.0
A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102…
-
High 7.8
A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functio…
-
High 8.8
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
-
High 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Ove…
-
High 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Ove…
-
Medium 5.5CVE-2022-31902 Public exploit
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
High 7.2
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.ph…
-
Medium 4.9
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
-
Critical 9.8
A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to …
-
Medium 6.1CVE-2022-46934 Scanner template
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /contro…
-
Medium 6.5
An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the d…
-
High 8.8CVE-2022-45782 Public exploit
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure…
-
High 8.2
In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, …
-
Critical 9.8
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution …
-
Critical 9.8
A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functional…
-
High 7.8
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege …
-
High 7.8
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local at…
-
Medium 6.5
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to…
-
Medium 5.3
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to …
-
Critical 9.8
Last Yard 22.09.8-1 does not enforce HSTS headers
-
Critical 9.8
An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to …
-
Critical 9.8CVE-2022-47003 Scanner template
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via …
-
High 7.5
Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.
-
Unscored —CVE-2022-47002 Scanner template
A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authenticati…
-
Critical 9.8
Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
-
Medium 5.3
In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
-
High 7.5
Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
-
Unscored —CVE-2022-47872 Public exploit
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbi…
-
High 7.5
A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on t…