Archive
7 February 2023
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
High 8.1
Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev
Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may …
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-lev…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes it possible for unauthenticated at…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-lev…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes it possible for unauthentica…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes it possible for unauthenticated …
-
Medium 6.4
Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting
The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This ma…
-
Medium 5.4
LogicalDOC Document Version Comment Stored XSS
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.
-
Medium 5.4
LogicalDOC Document File Name Stored XSS
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.
-
Medium 5.4
Mayan EDMS Tag XSS
An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.
-
Medium 5.4
LogicalDOC Chat Stored XSS
LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system.
-
Medium 5.4
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in …
-
Medium 5.4
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II")…
-
Medium 5.4
LogicalDOC Messaging Stored XSS
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
-
Medium 5.4
Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-leve…
-
Medium 5.4
Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes it possible for unauthenticated at…
-
Medium 5.5
XpressEngine Update Query sql injection
A vulnerability was found in XpressEngine up to 1.4.4. It has been rated as critical. This issue affects some unknown processing of the component Update Query Handler. The manipulation leads to sql injection. Upgrading to version 1.4.5 is able to address this…
-
Medium 4.8
Cipher.update_into can corrupt memory in pyca cryptography
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…
-
Low 3.5
SourceCodester Online Eyewear Shop POST Request Users.php registration cross site scripting
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registration of the file oews/classes/Users.php of the component POST Request Handler. The manipulation of t…
-
Medium 5.4
ONLYOFFICE Workspace Search Stored XSS
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
-
High 8.8
Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security prot…
-
Medium 4.4
User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip
Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitrary `Content-Type` which would be served from the Zulip hostname with `Content-Disposition: inline` …
-
Medium 5.9
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
### Impact During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. ### Workaround None, upgrade to …
-
Medium 5.9
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
### Impact When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. ### Workaround N…
-
High 8.8
Persisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows …
-
Critical 10.0
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlin…
-
Medium 5.5
weblabyrinth labyrinth.inc.php Labyrinth sql injection
A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier o…
-
Medium 5.9
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial E…
-
Medium 5.3CVE-2022-40224 EPSS 65%
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Sw…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 5.3
An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial …
-
Medium 5.5
SourceCodester Medical Certificate Generator App function.php delete_record sql injection
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete_record of the file function.php. The manipulation of the argument id leads to sql injection. VDB-22…
-
Low 2.6
Custom-Content-Width custom-content-width.php register_settings cross site scripting
A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scri…
-
Low 3.5
OpenSeaMap online_chart index.php init cross site scripting
A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack rem…
-
High 7.0
Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locall…
-
Medium 6.3
SourceCodester Medical Certificate Generator App manage_record.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql inj…
-
Medium 5.0
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator pri…