Archive
March 2023
Vulnerabilities first published in this month (UTC), newest first.
25 results · Clear filters · Feed
-
Medium 6.3CVE-2023-1773 Public exploit
Rockoa Configuration File webmainConfig.php code injection
A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiat…
-
Medium 5.3CVE-2023-1258 Public exploit
Flow-X disclosure of sensitive information to unauthenticated users
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.
-
Medium 6.5
request-baskets vulnerable to Server-Side Request Forgery
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
-
Medium 6.1CVE-2023-26692 Public exploit
ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Managem…
-
Medium 6.5CVE-2023-27167 Public exploit
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/ab…
-
Medium 5.4CVE-2023-26982 Public exploit
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter u…
-
Medium 5.4CVE-2022-1274 Public exploit
HTML Injection in Keycloak Admin REST API
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
-
Medium 4.6CVE-2022-48429 Public exploit
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
-
Medium 6.5CVE-2022-32199 Public exploit
db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory trave…
-
Medium 5.5CVE-2023-21036 Public exploit
In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidV…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
Medium 6.1CVE-2022-45004 Public exploit
Gophish vulnerable to Cross-site Scripting via crafted landing page
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
-
Medium 6.3CVE-2023-1498 Public exploit
code-projects Responsive Hotel Site Newsletter Log messages.php sql injection
A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. …
-
Medium 6.1
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.
-
Medium 6.3
jeecg-boot qurestSql sql injection
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The ex…
-
Medium 4.5CVE-2023-23408 Public exploit
Azure Apache Ambari Spoofing Vulnerability
Azure Apache Ambari Spoofing Vulnerability
-
Medium 6.5CVE-2023-23396 Public exploit
Microsoft Excel Denial of Service Vulnerability
Microsoft Excel Denial of Service Vulnerability
-
Medium 5.0CVE-2023-23638 Public exploit
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x …
-
Medium 6.1
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass paramete…
-
Medium 6.8CVE-2022-41333 Public exploit
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below…
-
Medium 5.4CVE-2022-44875 Public exploit
KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows a…
-
Medium 5.4CVE-2022-42248 Public exploit
QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient funct…
-
Medium 6.1
Open redirect in web2py
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
-
Medium 4.7CVE-2023-1112 Public exploit
Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative…
-
Medium 6.6CVE-2022-3294 Public exploit
Node address isn't always verified when proxying
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserv…