Archive
9 March 2023
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Medium 6.3
UCMS System File Management Module fileedit.php unrestricted upload
A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component System File Management Module. The manipulation of the argument file leads to unrestricted upload. Th…
-
Medium 6.3
SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this issue is some unknown functionality of the file deleteorder.php of the component GET Parameter Handler.…
-
Medium 6.3
SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injection
A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of t…
-
Medium 6.2
Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patc…
-
Medium 5.9
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method wi…
-
Medium 6.8
ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability
An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.
-
Medium 4.9
Consul Server Panic when Ingress and API Gateways Configured with Peering
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.
-
Medium 5.0
SourceCodester Online Graduate Tracer System admin_cs.php mysqli_query sql injection
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. The attack may be initiated remotely. The…
-
Medium 6.3
SourceCodester Sales Tracker Management System Master.php delete_client sql injection
A vulnerability has been found in SourceCodester Sales Tracker Management System 1.0 and classified as critical. This vulnerability affects the function delete_client of the file classes/Master.php. The manipulation of the argument id leads to sql injection. …
-
Medium 6.3
SourceCodester Sales Tracker Management System manage_client.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argument id leads to sql injection. It is pos…
-
Medium 6.3
SourceCodester Sales Tracker Management System view_client.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The manipulation of the argument id leads …
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting f…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting f…
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting fr…
-
Medium 4.6
Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure Vulnerability
A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to view sensitive files on the console using the GRUB bootloader command line. This vulnerability is du…
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions startin…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before…
-
Medium 5.0
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sen…
-
Medium 5.0
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting f…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting f…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15…