Archive
13 February 2023
Vulnerabilities first published on this day (UTC), newest first.
119 results · Feed
-
Medium 6.8
LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-s…
-
Medium 6.8
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and to…
-
Critical 9.8
ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.
-
High 7.5
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
-
Medium 6.1
Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.
-
Critical 9.8
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attacke…
-
Medium 5.5
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Acc…
-
Medium 6.1
SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/…
-
Critical 9.1
Arbitrary file deletion in ureport
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
-
Medium 5.4
Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
-
Critical 9.8
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrate…
KEV May 12, 2023 -
Medium 6.1
bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
-
Unscored —
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additi…
-
High 8.8
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such…
-
High 8.8
SameSite Attribute vulnerability in pimCore
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.5
SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a cred…
-
Medium 5.9
Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify serve…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error ha…
-
Critical 9.1
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated a…
-
High 7.8
Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of erro…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
Medium 6.4
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versio…
-
Critical 9.8
Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. …
-
Critical 9.8
NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affec…
-
High 7.8
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate pri…
-
Medium 6.1CVE-2022-48110 Public exploit
CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured C…
-
Medium 6.5
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions star…
-
Medium 6.1
Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).
-
Medium 5.4
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform an…
-
High 8.8
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute a…
-
Medium 6.5
Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via Calenda…
-
Critical 9.8
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
-
High 7.5
Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If…
-
Critical 9.8
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass au…