Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
Medium 5.5
Twister Antivirus IoControlCode filmfd.sys 0x801120E4 denial of service
A vulnerability was found in Twister Antivirus 8.17. It has been rated as problematic. This issue affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to b…
-
Medium 5.3
Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control
A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. The…
-
Low 3.5
SourceCodester Medical Certificate Generator App New Record cross site scripting
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been classified as problematic. This affects an unknown part of the component New Record Handler. The manipulation of the argument Firstname/Middlename/Lastname/Suffix/N…
-
Medium 5.3
JP1016 Markdown-Electron code injection
A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public …
-
Medium 5.3
MarkText WSH JScript code injection
A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required …
-
Medium 5.3
Typora WSH JScript code injection
A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit …
-
Medium 4.3
MuYuCMS index.php path traversal
A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The manipulation of the argument file_path leads to path traversal. The attack may be initiated remotely. Th…
-
Medium 4.3
SourceCodester Sales Tracker Management System cross-site request forgery
A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file admin/?page=user/list. The manipulation leads to cross-site request forgery. The attack can be initi…
-
Medium 6.5
SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control
A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to …
-
High 7.3
SourceCodester Moosikay E-Commerce System POST Parameter order.php sql injection
A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Moosikay/order.php of the component POST Parameter Handler. The manipulation of the ar…
-
High 7.5
rangy vulnerable to Prototype Pollution
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
-
Medium 4.6
Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller
Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: …
-
High 7.8
There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker coul…
-
Medium 5.3
A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log f…
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
-
Low 3.3
RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions
In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in unilogies/bumsys
Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.
-
Critical 9.8
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a c…
-
Medium 5.5
An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/…
-
Medium 5.4
Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remot…
-
Medium 4.8
Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows …
-
Medium 6.1
@braintree/sanitize-url Cross-site Scripting vulnerability
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
-
Medium 5.5
ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c.
-
High 7.5
ecdh vulnerable to Exposure of Resource to Wrong Sphere
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
-
High 8.8
Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges vi…
-
High 7.5
SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive informati…
-
Critical 9.6
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get reques…
-
Unscored —
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a cra…
-
Unscored —
Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive inf…
-
Unscored —
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on …
-
Critical 9.8
An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.
-
High 7.5
mod_gnutls contains Infinite Loop on request read timeout
Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read oper…
-
Medium 5.4
Gradio contains Use of Hard-coded Credentials
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=…
-
Critical 9.8
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the …
-
Critical 9.8CVE-2023-0755 EPSS 12%
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash t…
-
Medium 4.3
MantisBT: Exposure of Private issues' summary to unauthorized users
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private v…
-
Medium 5.4
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
-
Medium 5.2
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
-
Medium 5.4CVE-2022-48343 EPSS 59%
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
-
Medium 4.3
SourceCodester Online Pizza Ordering System cross-site request forgery
A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipulation leads to cross-site request forge…