Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
94 results · Clear filters · Feed
-
Low 3.3
In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due …
-
Low 2.6
Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended tha…
-
Low 2.7
Disclosure of team owner email address when when accessing the teams API
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
-
Low 2.7
Disclosure of team owner email address when regenerating Invite ID
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monter…
-
Low 3.8
MuYuCMS filesdel.html path traversal
A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accessory/filesdel.html. The manipulation of the argument filedelur leads to relative path traversal. The a…
-
Low 3.5
SourceCodester Online Pet Shop We App update_status.php cross site scripting
A vulnerability has been found in SourceCodester Online Pet Shop We App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /pet_shop/admin/orders/update_status.php. The manipulation of the argument oid with the input 1"><sc…
-
Low 3.5
SourceCodester Simple Responsive Tourism Website rate_review.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Responsive Tourism Website 1.0. This affects an unknown part of the file /tourism/rate_review.php. The manipulation of the argument id with the input 1"><script>alert(111…
-
Low 3.5
dro.pm fileman.php cross site scripting
A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. Thi…
-
Low 3.5
SourceCodester/code-projects Online Boat Reservation System POST Parameter login.php cross site scripting
A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /boat/login.php of the component POST Parameter Handler. Th…
-
Low —
Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
The `remove_dir_all` crate is a Rust library that offers additional features over the Rust standard library `fs::remove_dir_all` function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause…
-
Low 3.5
SourceCodester Medical Certificate Generator App New Record cross site scripting
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been classified as problematic. This affects an unknown part of the component New Record Handler. The manipulation of the argument Firstname/Middlename/Lastname/Suffix/N…
-
Low 3.3
RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions
In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.
-
Low 3.5
SourceCodester Online Pizza Ordering System cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated re…
-
Low 3.3
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatur…
-
Low 3.3
markdown-it-py crash on null assertions
Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
-
Low 3.3
markdown-it-py CLI crash on invalid UTF-8 characters
Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
-
Low 2.4
SourceCodester Online Eyewear Shop cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=orders/view_order. The manipulation of the argument id leads to cross site script…
-
Low 3.3
Imperative Local Command Injection allows Activity Masking
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
-
Low 3.5
NHN TOAST UI Chart Legend cross site scripting
A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely.…
-
Low 3.5
SourceCodester Best POS Management System cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerro…
-
Low 3.1
Codiad process.php saveJSON information disclosure
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information…
-
Low 3.5
GoPistolet MTA denial of service
A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefo…
-
Low 3.5
Watu Quiz < 3.3.8.3 - Admin+ Stored XSS
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Low 3.5
cention-chatserver InternalChatProtocol.fe _formatBody cross site scripting
A vulnerability was found in cention-chatserver 3.8.0-rc1. It has been declared as problematic. Affected by this vulnerability is the function _formatBody of the file lib/InternalChatProtocol.fe. The manipulation of the argument body leads to cross site scrip…
-
Low 3.5
rtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of service
A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation leads to denial of …
-
Low 3.5
meta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scripting
A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicat…
-
Low 3.5
generator-hottowel 404 Error _app.js cross site scripting
A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It i…
-
Low 3.5
NREL api-umbrella-web Admin Data Table cross site scripting
A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remo…
-
Low 3.5
qt-users-jp silk header.qml cross site scripting
A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripti…
-
Low 2.5
doomsider shadow denial of service
A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitabil…
-
Low 3.5
madgicweb BuddyStream Plugin ShareBox.php cross site scripting
A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares …
-
Low 3.3
cxasm notepad-- Directory Comparison denial of service
A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The as…
-
Low 3.5CVE-2023-0902 Public exploit
SourceCodester Simple Food Ordering System process_order.php cross site scripting
A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possibl…
-
Low 3.8
Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially …
-
Low 3.3
Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 …
-
Low 3.3
Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authentica…
-
Low 2.2
NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to po…
-
Low 2.8
Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user t…
-
Low 3.1
Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially…