Archive
March 2023
Vulnerabilities first published in this month (UTC), newest first.
1,048 results · Clear filters · Feed
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust …
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown pr…
-
Medium 6.3
HadSky Installation Interface index.php command injection
A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of the component Installation Interface. The manipulation leads to command injection. The attack can be …
-
Medium 6.6
QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fix…
-
Medium 4.7
HadSky unrestricted upload
A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin:index. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotel…
-
Medium 4.3
Xunrui CMS system_log.html information disclosure
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remote…
-
Medium 5.1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
-
Medium 4.0
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
-
Medium 4.0
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
-
Medium 5.3
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
-
Medium 6.5CVE-2023-27167 Public exploit
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/ab…
-
Medium 5.4CVE-2023-26982 Public exploit
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter u…
-
Medium 5.4CVE-2022-1274 Public exploit
HTML Injection in Keycloak Admin REST API
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
-
Medium 5.5CVE-2022-36969 EPSS 14%
This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…
-
Medium 6.5CVE-2022-36982 EPSS 74%
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.…
-
Medium 5.0
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected …
-
Medium 6.3
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…
-
Medium 5.5
NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.
-
Medium 5.5
NASM v2.16 was discovered to contain a null pointer deference in the NASM component
-
Medium 6.4
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-…
-
Medium 5.1
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kern…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 4.3
Xunrui CMS Install.txt direct request
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotel…
-
Medium 4.3
Xunrui CMS test.php information disclosure
A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The explo…
-
Medium 5.3
DriverGenius IOCTL mydrivers64.sys 0x9C40A108 memory corruption
A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack ha…
-
Medium 5.3
DriverGenius IOCTL mydrivers64.sys 0x9C40A0E0 memory corruption
A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. The attack…
-
Medium 5.5
DriverGenius IOCTL mydrivers64.sys 0x9c402084 denial of service
A vulnerability was found in DriverGenius 9.70.0.346. It has been rated as problematic. Affected by this issue is the function 0x9c40a0c8/0x9c40a0dc/0x9c40a0e0/0x9c40a0d8/0x9c4060d4/0x9c402004/0x9c402088/0x9c40208c/0x9c4060d0/0x9c4060cc/0x9c4060c4/0x9c402084 …
-
Medium 6.3
SourceCodester School Registration and Fee System GET Parameter edit_stud.php sql injection
A vulnerability was found in SourceCodester School Registration and Fee System 1.0. It has been classified as critical. Affected is an unknown function of the file /bilal final/edit_stud.php of the component GET Parameter Handler. The manipulation of the argu…