Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
994 results · Clear filters · Feed
-
Medium 5.4
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform an…
-
Medium 6.5
Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via Calenda…
-
Medium 4.3
simple-markdown simple-markdown.js redos
A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack c…
-
Medium 4.3
simple-markdown simple-markdown.js redos
A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression co…
-
Medium 6.5
Code Injection in thorsten/phpmyfaq
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
Medium 4.7
EcShop PHP File template.php unrestricted upload
A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the…
-
Medium 6.3
SourceCodester Canteen Management System removeOrder.php query sql injection
A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file removeOrder.php. The manipulation of the argument id leads to sql injection. The attack can …
-
Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
-
Medium 5.7
Login fail open on JAAS misconfiguration in DataHub
DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open …
-
Medium 6.9
Failure to Invalidate Session on Logout in DataHub
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypass…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 6.8
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin c…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disabl…
-
Medium 5.3
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attac…
-
Medium 4.8
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerabilit…
-
Medium 6.7
PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin use…
-
Medium 6.0
PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenti…
-
Medium 6.0
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privilege…
-
Medium 5.9
Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated …
-
Medium 6.5
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A loc…
-
Medium 5.5
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An aut…
-
Medium 6.4
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) con…
-
Medium 4.5
set_term_title command injection in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific …
-
Medium 6.5
Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerabili…
-
Medium 4.4
Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnera…
-
Medium 5.0
CodenameOne implicit intent for sensitive communication
A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity…
-
Medium 6.3
webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql inject…
-
Medium 4.7
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A…
-
Medium 5.5
Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on …
-
Medium 5.3CVE-2018-7935 Public exploit
There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerabili…
-
Medium 6.8
Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the…
-
Medium 6.7
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a heap-based buffer overflow. A local privileged malicious user co…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of I…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inve…
-
Medium 4.8
Formwork Cross-site Scripting (XSS) from Page title field
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Invento…