Archive
3 February 2023
Vulnerabilities first published on this day (UTC), newest first.
117 results · Feed
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in…
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in …
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter …
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the …
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop para…
-
Unscored —
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of ser…
-
Critical 9.8
Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString functi…
-
Medium 5.4
Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
-
Critical 9.8
An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.
-
Medium 5.4
Jellyfin Web Cross-Site Scripting (XSS) via Collection Name
In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
-
Critical 9.8
Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute …
-
Unscored —
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed …
-
Critical 9.8
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP reque…
-
Critical 9.8
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct…
-
Unscored —
A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HT…
-
High 8.4
VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on t…
-
High 7.5
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers…
-
Critical 9.1
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are ac…
-
Medium 4.3
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to vi…
-
Unscored —CVE-2022-48165 Scanner template
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthe…
-
Unscored —
An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
-
Critical 9.8
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted messag…
-
Unscored —
Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of…
-
Unscored —
Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153c…
-
High 7.8
Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b15…
-
High 7.8
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) ty…
-
High 8.8
Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b1…
-
Unscored —
Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b1…
-
Medium 6.3
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker t…
-
Medium 6.5
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and as…
-
High 7.5
Path Traversal in gin-vue-admin
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
-
Unscored —CVE-2022-47132 Public exploit
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
-
High 7.5
NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the serv…
-
Medium 4.8CVE-2022-47131 Public exploit
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
-
Medium 4.3CVE-2022-47130 Public exploit
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if a…
-
Medium 5.5
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js …
-
High 7.5
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path…
-
High 7.5
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie inform…
-
Critical 9.8
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article pa…
-
High 8.1
Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt p…