Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
High 8.4
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upl…
-
Medium 6.1
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 7…
-
Medium 6.5
SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to…
-
Medium 4.3
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inp…
-
Medium 6.5
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticate…
-
High 8.8
An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start …
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 74…
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, …
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 7…
-
Medium 4.3
In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json wi…
-
Medium 6.5
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insuf…
-
Low 3.8
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not…
-
Medium 6.1
An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740…
-
Medium 6.1
SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting …
-
Medium 5.4
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload a…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
High 8.5
SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sens…
-
Medium 6.5
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V…
-
Medium 6.5
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user…
-
High —
Vulnerable OpenSSL included in sgx-dcap-quote-verify-python
sgx-dcap-quote-verify-python includes a statically linked copy of OpenSSL. The version of OpenSSL included in sgx-dcap-quote-verify-python 0.0.1..0.0.2 is vulnerable to a security issue. More details about the OpenSSL vulnerabilities themselves can be found a…
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
-
Medium 5.3
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an erro…
-
High 7.8
XML External Entity Reference in ureport
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in t…
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in t…
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter i…
-
Medium 4.2
Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain t…
-
Critical 9.1CVE-2023-25725 Public exploit
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…
-
High 8.8
An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the…
-
High 8.8
Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions al…
-
Medium 6.1
Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allow…
-
Unscored —
Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a…
-
High 8.8
LexisNexis Firco Compliance Link 3.7 allows CSRF.
-
Medium 6.8
TIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability
The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software…
-
High 7.5
An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability cau…
-
Low 3.5
juju2143 WalrusIRC parser.js parseLinks cross site scripting
A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated …
-
Low 3.5
UDX Stateless Media Plugin class-settings.php setup_wizard_interface cross site scripting
A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settin…