Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
Critical 9.8
Cloudflow - Unauthenticated file upload vulnerability
Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage.
-
Medium 6.5
Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to ac…
-
High 8.8
Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privi…
-
High 8.8
Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an auth…
-
Low 3.5
NHN TOAST UI Chart Legend cross site scripting
A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely.…
-
Medium 4.8
Cross-site Scripting (XSS) - Reflected in modoboa/modoboa
Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
-
High 8.1CVE-2023-0947 Scanner template
Path Traversal in flatpressblog/flatpress
Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
-
Critical 9.8
MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request p…
-
Critical 9.8
An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password.
-
Critical 9.8
hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution bac…
-
Critical 9.8
typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php.
-
Unscored —CVE-2023-23063 Scanner template
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetF…
-
Medium 5.7
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use…
-
High 7.5
TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for bas…
-
Unscored —CVE-2023-22974 Public exploit
A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by control…
-
Unscored —
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < …
-
Unscored —
A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticate…
-
High 7.3
TIBCO BusinessConnect Reflected XSS Vulnerability
The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected…
-
High 8.8
The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-…
-
Unscored —
File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attac…
-
Unscored —CVE-2022-29273 EPSS 60%
pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
-
Unscored —
Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via…
-
High 7.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
High 8.8CVE-2022-45600 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attacker…
-
Critical 9.8CVE-2022-45599 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, a…
-
High 7.3
TIBCO BusinessConnect Stored XSS Vulnerability
The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting (XSS) attack on the affected system. Affec…
-
High 8.7
TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TI…
-
High 8.7
TIBCO EBX Cross Site Scripting (XSS) Vulnerability
The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the a…
-
Unscored —
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.
-
Critical 9.8
Unfiltered SQL Injection Vulnerabilities in Geoserver
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS)…
-
Critical 9.8
Unfiltered SQL Injection in Geotools
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when exec…
-
High 7.5
Remote code execution in Jinja2 template rendering in Nautobot
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has …
-
Medium 6.3
Persistent Cross site scripting (XSS) in Uptime Kuma
Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability.
-
Medium 6.3
Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma
Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability.
-
Medium 6.5
Allowed DELETE on resources on object locked buckets under Governance mode in Minio
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Gove…
-
Medium 6.3
InSTEDD Pollit tour_controller.rb TourController Privilege Escalation
A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotel…
-
Medium 6.3
SourceCodester Best POS Management System sql injection
A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file billing/index.php?id=9. The manipulation of the argument id leads to sql injecti…
-
Low 3.5
SourceCodester Best POS Management System cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerro…
-
Medium 4.7CVE-2023-0943 Public exploit
SourceCodester Best POS Management System Image save_settings unrestricted upload
A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of t…
-
Medium 6.1CVE-2023-0942 Scanner template
Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthent…