Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
Medium 5.9
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial E…
-
Medium 5.3CVE-2022-40224 EPSS 65%
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Sw…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 4.3
A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industr…
-
Medium 5.3
An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial …
-
Medium 5.5
SourceCodester Medical Certificate Generator App function.php delete_record sql injection
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete_record of the file function.php. The manipulation of the argument id leads to sql injection. VDB-22…
-
Low 2.6
Custom-Content-Width custom-content-width.php register_settings cross site scripting
A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scri…
-
Low 3.5
OpenSeaMap online_chart index.php init cross site scripting
A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack rem…
-
High 7.0
Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locall…
-
Medium 6.3
SourceCodester Medical Certificate Generator App manage_record.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql inj…
-
Medium 5.0
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator pri…
-
Medium 6.8
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an att…
-
High 8.2
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experie…
-
Medium 6.5
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PAS…
-
Medium 5.3
Denial Of Service when opening a corrupt PDF file in pdfio
PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Unscored —
Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to…
-
Medium 6.5
Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potential…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corr…
-
High 8.8
Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap cor…
-
Medium 6.5
Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass…
-
Unscored —
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote at…
-
High 8.8
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bou…
-
Unscored —
Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user …
-
High 7.5
Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition…
-
Unscored —
Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to en…
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in wallabag/wallabag
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Medium 6.1
Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to e…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
-
Medium 6.3
libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially cra…
-
High 8.8
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to com…
-
High 7.2
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4…
-
High 7.5
[RANCHER] OS command injection in Rancher and Fleet
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affect…
-
High 7.8
rmt-server-pubcloud allows to escalate from user _rmt to root
A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with…
-
Critical 9.8
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…
KEV Feb 10, 2023 -
High 7.5
A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition …
-
High 7.5
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
-
Medium 6.5
An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of serv…
-
Medium 6.5
An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of serv…