Archive
3 March 2023
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
High 8.8
Refresh tokens do not expire in Vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
-
High 7.3
mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A maliciou…
-
High 7.5
Yapscan Denial of Service vulnerability in report server
### Impact If you use the report server, it may be vulnerable to a Denial of Service attack. ### Patches Has been patched in v0.19.2. ### References The vulnerability was inherited by the following upstream vulnerabilites - [golang.org/x/text < v0.3.7](https:…
-
High 8.2
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CS…
-
High 8.4
KylinSoft kylin-activation File Import improper authorization
A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approach…
-
High 7.2CVE-2023-1162 EPSS 26%
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the…
-
High 7.5
Information Disclosure Vulnerability in MELSEC Series
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and…
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
-
High 7.5
phpseclib Infinite Loop vulnerability
Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
High 7.5
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the store…
-
High 7.5
CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file,…
-
High 7.8
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible s…
-
High 7.2
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injecti…
-
High 7.8CVE-2022-45988 Public exploit
starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted f…
-
High 7.8
Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse
-
High 7.8
Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)