Archive
6 March 2023
Vulnerabilities first published on this day (UTC), newest first.
101 results · Feed
-
Medium 4.7
ECshop Backup Database database.php unrestricted upload
A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file admin/database.php of the component Backup Database Handler. The manipulation leads to unrestricted up…
-
Medium 5.3
Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
-
Low 2.6
Mark User as Spammer Plugin plugin.php user_row_actions cross site scripting
A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads t…
-
High 8.5
Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.
-
High 8.5
Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.
-
Low 3.5
Qtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scripting
A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function add_slug_meta_box of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It…
-
Low 3.7
@nestjs/core vulnerable to Information Exposure via StreamableFile pipe
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the…
-
Medium 6.9
SketchSVG Arbitrary Code Injection vulnerability
All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.
-
High 7.5
node-static and @nubosoftware/node-static vulnerable to Directory Traversal
All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.
-
High 7.5
dot-lens vulnerable to Prototype Pollution
All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.
-
Medium 4.7
ByWater Solutions bywater-koha-xslt systempreferences.pl StringSearch sql injection
A vulnerability has been found in ByWater Solutions bywater-koha-xslt and classified as critical. This vulnerability affects the function StringSearch of the file admin/systempreferences.pl. The manipulation of the argument name leads to sql injection. The at…
-
Low 3.5
icplayer tts-utils.js cross site scripting
A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched r…
-
Low 3.5
icplayer presenter.js AddonText_Selection_create cross site scripting
A vulnerability was found in icplayer up to 0.819. It has been declared as problematic. Affected by this vulnerability is the function AddonText_Selection_create of the file addons/Text_Selection/src/presenter.js. The manipulation leads to cross site scriptin…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
High 8.8
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third …
-
Medium 5.9
Cross-site Scripting (XSS) - Stored in phpipam/phpipam
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
-
Medium 6.3
ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via pa…
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
-
High 7.2CVE-2023-1211 Public exploit
SQL Injection in phpipam/phpipam
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
-
Critical 9.8
Remote code execution in Funadmin
Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.
-
Unscored —CVE-2023-24733 Scanner template
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /a…
-
Unscored —
PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure…
-
High 8.8
jeecg-boot contains SQL Injection vulnerability
jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.
-
Unscored —CVE-2023-24735 Scanner template
PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerabi…
-
Unscored —CVE-2023-24737 Scanner template
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /a…
-
High 8.8CVE-2023-24217 Public exploit
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
-
Unscored —CVE-2023-24734 EPSS 21%
An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arb…
-
High 8.8
In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to …
-
High 7.5
Insufficient Session Expiration in pretix
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
-
Unscored —
An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack…
-
Unscored —
ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and…
-
Unscored —
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to…
-
Unscored —CVE-2023-26601 EPSS 34%
Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and S…
-
Low 2.8
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability
A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.
-
High 8.6
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…
-
Medium 4.3
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 doe…
-
Medium 6.5
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by…
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl funct…
-
Medium 6.5
openstack-neutron uncontrolled resource consumption flaw
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a mal…
-
Medium 5.5
A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resou…