Archive
31 March 2023
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Medium 4.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for Grow…
-
Medium 6.5
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissi…
-
Critical 9.8
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
-
Medium 5.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see…
-
High 7.2
forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}…
-
Critical 9.1
OpenAPI Generator vulnerable to Server-Side Request Forgery
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
-
High 7.5
Appwrite Server-Side Request Forgery vulnerability
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
-
Medium 6.5
request-baskets vulnerable to Server-Side Request Forgery
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
-
Critical 9.8
An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3…
-
Unscored —
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack befor…
-
Unscored —
SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faq…
-
High 7.5
An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30. A specially crafted …
-
Critical 9.8
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows …
-
High 7.5
zstd vulnerable to buffer overrun
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
-
High 7.5
X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.
-
High 7.5
Improper Input Validation in Generex CS141
There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
-
High 8.8
Admin password reset via file upload vulnerability in Generex CS141
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
-
Critical 10.0
RCE via file upload vulnerability in Generex CS141
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
-
High 7.5
DoS via file upload vulnerability at Generex CS141
Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.
-
Medium 4.3
Privilege Escalation via file upload vulnerability at Generex CS141
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.