Archive
10 February 2023
Vulnerabilities first published on this day (UTC), newest first.
35 results · Clear filters · Feed
-
Medium 5.7
Login fail open on JAAS misconfiguration in DataHub
DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open …
-
Medium 6.9
Failure to Invalidate Session on Logout in DataHub
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypass…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 6.8
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin c…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disabl…
-
Medium 5.3
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attac…
-
Medium 4.8
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerabilit…
-
Medium 6.7
PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin use…
-
Medium 6.0
PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenti…
-
Medium 6.0
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privilege…
-
Medium 5.9
Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated …
-
Medium 6.5
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A loc…
-
Medium 5.5
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An aut…
-
Medium 6.4
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) con…
-
Medium 4.5
set_term_title command injection in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific …
-
Medium 6.5
Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerabili…
-
Medium 4.4
Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnera…
-
Medium 5.0
CodenameOne implicit intent for sensitive communication
A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity…
-
Medium 6.3
webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql inject…
-
Medium 4.7
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A…
-
Medium 5.5
Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on …
-
Medium 5.3CVE-2018-7935 Public exploit
There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerabili…
-
Medium 6.8
Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the…
-
Medium 6.7
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a heap-based buffer overflow. A local privileged malicious user co…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of I…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inve…
-
Medium 4.8
Formwork Cross-site Scripting (XSS) from Page title field
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Invento…
-
Medium 6.1CVE-2023-23286 Public exploit
Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the …
-
Medium 4.9CVE-2022-46650 EPSS 12%
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the AC…
-
Medium 6.1
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).