Archive
31 March 2023
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 5.7
User without download rights can download older version of that file in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.…
-
Medium 5.7
Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recomme…
-
Medium 5.3
Quadratic complexity may lead to a denial of service in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity …
-
Medium 5.3
Quadratic complexity may lead to a denial of service in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity …
-
Medium 6.3
SourceCodester Earnings and Expense Tracker App manage_user.php sql injection
A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to la…
-
Medium 5.3
jeecg-boot API Documentation improper authentication
A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has b…
-
Medium 5.3
Improper Check for Unusual or Exceptional Conditions
Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6.
-
Medium 6.5
CVE-2023-0343
Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt messages.
-
Medium 6.3CVE-2023-1773 Public exploit
Rockoa Configuration File webmainConfig.php code injection
A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiat…
-
Medium 6.5
Information disclosure in linked message previews
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
-
Medium 4.3
Unsanitized events sent over Websocket to regular users in a High Availability environment
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket cli…
-
Medium 4.2
Unauthorized email invite to a private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.
-
Medium 6.3
SourceCodester Grade Point Average GPA Calculator Master.php get_scale sql injection
A vulnerability has been found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as critical. Affected by this vulnerability is the function get_scale of the file Master.php. The manipulation of the argument perc leads to sql injection. …
-
Medium 4.3
SourceCodester Grade Point Average GPA Calculator index.php information disclosure
A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page with the input php://filter/read=convert.bas…
-
Medium 6.1
XSS in YKM CRM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS. This issue affects YKM CRM: before 23.03.30.
-
Medium 5.3CVE-2023-1258 Public exploit
Flow-X disclosure of sensitive information to unauthenticated users
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.
-
Medium 5.3
Ruby URI component ReDoS issue
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…
-
Medium 4.7
Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 6.3
Cross-site Scripting in thorsten/phpmyfaq
Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.5
Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 4.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for Grow…
-
Medium 6.5
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissi…
-
Medium 5.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see…
-
Medium 6.5
request-baskets vulnerable to Server-Side Request Forgery
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
-
Medium 4.3
Privilege Escalation via file upload vulnerability at Generex CS141
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.