Archive
3 February 2023
Vulnerabilities first published on this day (UTC), newest first.
33 results · Clear filters · Feed
-
Medium 5.5
fanzila WebFinance save_contact.php sql injection
A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file htdocs/prospection/save_contact.php. The manipulation of the argument nom/prenom/email/tel/mobile/cli…
-
Medium 5.5
fanzila WebFinance save_roles.php sql injection
A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c…
-
Medium 5.3
Malicious users in Discourse can create spam topics as any user due to improper access control
Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a wo…
-
Medium 5.9CVE-2022-24894 Public exploit
Symfony storing cookie headers in HttpCache
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the…
-
Medium 6.3
Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSR…
-
Medium 5.3
Specially crafted RTPS message may cause an OpenDDS application to crash
OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched i…
-
Medium 5.5
fanzila WebFinance save_taxes.php sql injection
A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203a…
-
Medium 5.5
fanzila WebFinance save_Contract_Signer_Role.php sql injection
A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is iden…
-
Medium 6.4
OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, an…
-
Medium 5.7
Issue in Anomaly Detection with document and field level rules in numerical feature aggregations
OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read ag…
-
Medium 6.5
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
-
Medium 5.3
BDCOM 1704-WGL Backup File param.file.tgz information disclosure
A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initia…
-
Medium 4.9
The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb …
-
Medium 5.4
Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
-
Medium 5.4
Jellyfin Web Cross-Site Scripting (XSS) via Collection Name
In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
-
Medium 4.3
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to vi…
-
Medium 6.3
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker t…
-
Medium 6.5
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and as…
-
Medium 4.8CVE-2022-47131 Public exploit
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
-
Medium 4.3CVE-2022-47130 Public exploit
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if a…
-
Medium 5.5
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js …
-
Medium 6.5
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TG…
-
Medium 5.4
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $fi…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run a…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyrig…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping functi…
-
Medium 6.5
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows r…
-
Medium 5.5
Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted a…
-
Medium 5.4
Cross site scripting in automad/automad
Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attac…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote …
-
Medium 6.1
Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run…