Archive
March 2023
Vulnerabilities first published in this month (UTC), newest first.
1,048 results · Clear filters · Feed
-
Medium 5.3
AEM Weak Cryptography for Passwords Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complex…
-
Medium 5.4
AEM URL Redirection to Untrusted Site Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitat…
-
Medium 5.4
AEM URL Redirection to Untrusted Site Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitat…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may b…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may b…
-
Medium 5.4
AEM URL Redirection to Untrusted Site Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitat…
-
Medium 5.4
AEM URL Redirection to Untrusted Site Security feature bypass
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitat…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may b…
-
Medium 4.3
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain …
-
Medium 6.1CVE-2022-45004 Public exploit
Gophish vulnerable to Cross-site Scripting via crafted landing page
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
-
Medium 5.5
CVE-2022-46286
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-45468
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-45121
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-41696
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-43512
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-46300
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 6.3
zwczou WeChat SDK Python to_xml xml external entity reference
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 …
-
Medium 6.5
A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.…
-
Medium 6.5
IBM Security Key Lifecycle Manager SQL injection
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-en…
-
Medium 6.2
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.
-
Medium 4.3
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary file…
-
Medium 4.3
IBM Security Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602.
-
Medium 5.4
IBM Security Key Lifecycle Manager improper authorization
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.
-
Medium 6.5
IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.
-
Medium 6.1
XSS in Pacsrapor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows Reflected XSS. This issue affects Pacsrapor: before 1.22.
-
Medium 5.4
WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
-
Medium 5.4
WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
-
Medium 5.4
WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
-
Medium 6.0
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in answerdev/answer
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Authentication Bypass by Capture-replay in answerdev/answer
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 6.8
Insufficient Session Expiration in answerdev/answer
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Timing Discrepancy in answerdev/answer
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 6.7
McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee sp…
-
Medium —
NULL pointer derefernce in `stb_image`
A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file. This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correct…
-
Medium 5.5CVE-2023-28425 EPSS 59%
Specially crafted MSETNX command can lead to denial-of-service
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Red…