Archive
10 February 2023
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
High 7.5
Server-Side Request Forgery in DataHub
DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Stor…
-
High 7.5
Deserialization of untrusted data in DataHub
DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub f…
-
High 8.2
System account impersonation in DataHub
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request …
-
High 8.2
JSON Injection in DataHub
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled dat…
-
High 8.1
Remote Code Execution in Baicells QRTB Platform
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with…
-
High 8.7
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
High 8.8
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execu…
-
High 8.8
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability…
-
High 7.2
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An aut…
-
High 8.8
PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated r…
-
High 7.1
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior…
-
High 7.8
Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior),…
-
High 7.7
Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A rem…
-
High 7.8
Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local a…
-
High 7.3
SourceCodester Medical Certificate Generator App action.php sql injection
A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname leads to sql injection. The attack can…
-
High 7.5
Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type…
-
High 7.2
SQL Injection in ampache/ampache
SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.
-
High 8.6
Authentication Bypass by Primary Weakness in modoboa/modoboa
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /gof…
-
High 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /gof…
-
High 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /gof…
-
High 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter a…
-
High 8.8
D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /gof…
-
High 8.8CVE-2022-46649 Public exploit
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to …