Archive
21 March 2023
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
Medium 5.5
CVE-2022-46286
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-45468
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-45121
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-41696
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-43512
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-46300
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 6.3
zwczou WeChat SDK Python to_xml xml external entity reference
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 …
-
Medium 6.5
A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.…
-
Medium 6.5
IBM Security Key Lifecycle Manager SQL injection
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-en…
-
Medium 6.2
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.
-
Medium 4.3
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary file…
-
Medium 4.3
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.
-
Medium 5.4
IBM Security Key Lifecycle Manager improper authorization
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.
-
Medium 6.5
IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.
-
Medium 6.1
XSS in Pacsrapor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows Reflected XSS. This issue affects Pacsrapor: before 1.22.
-
Medium 5.4
WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
-
Medium 5.4
WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
-
Medium 5.4
WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
-
Medium 6.0
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in answerdev/answer
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Authentication Bypass by Capture-replay in answerdev/answer
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 6.8
Insufficient Session Expiration in answerdev/answer
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Timing Discrepancy in answerdev/answer
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 6.7
McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee sp…