Skip to content
OpenAdvisories

Archive

25 February 2023

Vulnerabilities first published on this day (UTC), newest first.

← January 2023 2023 / February /25 March 2023 →
  1. 1120
  2. 250
  3. 3117
  4. 416
  5. 53
  6. 6187
  7. 784
  8. 875
  9. 9125
  10. 1074
  11. 115
  12. 1216
  13. 13119
  14. 14203
  15. 1594
  16. 16172
  17. 17101
  18. 1814
  19. 199
  20. 2051
  21. 2185
  22. 2261
  23. 2357
  24. 2452
  25. 2518
  26. 2621
  27. 27145
  28. 28115
All Critical High Medium Low Exploited only Public exploit

18 results · Feed

  • Medium 6.3
    CVE-2023-1035

    SourceCodester Clinics Patient Management System update_user.php sql injection

    A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the file update_user.php. The manipulation of the argument user_id leads to sql injection. It is possible…

    SourceCodester Clinics Patient Management System
  • High 7.5
    CVE-2023-26104

    Denial of Service vulnerability in lite-web-server

    All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

    lite-web-server npm
  • Medium 5.3
    CVE-2023-26103

    Regular Expression Denial of Service in Deno.upgradeWebSocket API

    Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafte…

    deno crates.io
  • High 7.1
    CVE-2023-26039 Public exploit

    ZoneMinder vulnerable to OS Command injection in daemonControl() API

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostCon…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • Medium 5.4
    CVE-2023-26038

    ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 8.9
    CVE-2023-26037

    ZoneMinder contains SQL Injection via report_event_audit

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly v…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 8.1
    CVE-2023-26036

    ZoneMinder contains Local File Inclusion vulnerability

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 7.2
    CVE-2023-26035 Public exploit Scanner template EPSS 80%

    ZoneMinder vulnerable to Missing Authorization

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. Ther…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu Alpine
  • Critical 9.6
    CVE-2023-26034

    ZoneMinder SQL Injection

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability …

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 8.9
    CVE-2023-26032

    ZoneMinder contains SQL injection via malicious Jason Web Token

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT toke…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 7.7
    CVE-2023-25825

    ZoneMinder contains Cross-site Scripting via log viewing

    ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, contain…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • Medium 6.8
    CVE-2023-1033

    Cross-Site Request Forgery (CSRF) in froxlor/froxlor

    Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Medium 4.3
    CVE-2023-1034 EPSS 26%

    Path Traversal: '\..\filename' in salesagility/suitecrm

    Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.

    salesagility salesagility/suitecrm
  • Critical 9.8
    CVE-2023-26550

    A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via…

  • Medium 4.7
    CVE-2023-26545

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-26544

    In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between N…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 8.8
    CVE-2022-48362

    Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName…

  • Critical 9.8
    CVE-2022-2024 EPSS 98%

    OS Command Injection in gogs/gogs

    OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

    Gogs gogs/gogs gogs.io/gogs Go