Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
731 results · Clear filters · Feed
-
High 8.8
Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced th…
-
High 8.8
Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit…
-
High 8.8
Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap…
-
High 8.8
Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit…
-
High 8.8
Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who ha…
-
High 7.1
Cross site scripting (XSS) vulnerability using authentication callback in Misskey
Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 (includin…
-
High 7.1
Cross site scripting (XSS) vulnerability using url preview in Misskey
Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL i…
-
High 8.8
SQL injection of notes/search-by-tag
Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users ar…
-
High 7.1
Cross site scripting (XSS) of ActivityPub URI in misskey
Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a ja…
-
High 7.3CVE-2023-0963 Public exploit
SourceCodester Music Gallery Site POST Request Users.php access control
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The …
-
High 8.3
Cloudflow - Local File Inclusion Vulnerability
Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system.
-
High 8.8
Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privi…
-
High 8.8
Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an auth…
-
High 8.1CVE-2023-0947 Scanner template
Path Traversal in flatpressblog/flatpress
Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
-
High 7.5
TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for bas…
-
High 7.3
TIBCO BusinessConnect Reflected XSS Vulnerability
The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected…
-
High 8.8
The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-…
-
High 7.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
High 8.8CVE-2022-45600 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attacker…
-
High 7.3
TIBCO BusinessConnect Stored XSS Vulnerability
The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting (XSS) attack on the affected system. Affec…
-
High 8.7
TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TI…
-
High 8.7
TIBCO EBX Cross Site Scripting (XSS) Vulnerability
The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the a…
-
High 7.5
Remote code execution in Jinja2 template rendering in Nautobot
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has …
-
High 7.5
Watu Quiz < 3.3.8.2 - Reflected XSS
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
High 7.8
Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privileg…
-
High 7.5
In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.
-
High 7.5
Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially …
-
High 7.8
afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overfl…
-
High 7.3
In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targe…
-
High 7.2CVE-2023-20858 EPSS 17%
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injecti…
-
High 8.8
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administr…
-
High 7.5
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party…
-
High 7.5
In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.
-
High 7.2
Visioweb.js - Prototype Pollution can results in XSS
Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.
-
High 8.0
Command injection in SMS notifications
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within …
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5
Apollo has potential access control security issue in eureka
Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-i…
-
High 7.5
notation-go has excessive memory allocation on verification
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will b…