Archive
March 2023
Vulnerabilities first published in this month (UTC), newest first.
2,519 results · Feed
-
Critical 9.1CVE-2023-26482 Public exploit
Scope of workflow operations is not validated in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defin…
-
Medium 4.4
App lockout in nextcloud Android app can be bypassed via thirdparty apps
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a t…
-
Medium 4.4
App pin of the iOS app can be bypassed in Nextcloud iOS
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextclo…
-
High 8.5
Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb
MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. This vulnerability …
-
Medium 5.8CVE-2022-43473 EPSS 20%
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12…
-
Medium 5.3
An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project O…
-
High 7.5
A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2…
-
High 7.5
An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenIma…
-
Critical 9.8CVE-2023-25076 EPSS 66%
A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master bra…
-
Critical 9.8
SSRF in Infoline Project Management System
Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125.
-
High 7.2
Stored XSS affecting the AcyMailing plugin for Joomla
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugi…
-
Medium 6.5
Missing access control affecting the AcyMailing plugin for Joomla
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. Thi…
-
Critical 9.8
Unauthenticated RCE affecting the AcyMailing plugin for Joomla
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin…
-
Medium 5.5
WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.
-
Medium 6.5
WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
-
Medium 6.5
WordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin <= 4.0 versions.
-
Low 3.8
WordPress GTmetrix for WordPress Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
-
Medium 5.9
WordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catchsquare WP Smart Preloader plugin <= 1.15 versions.
-
Medium 6.5
WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions.
-
Medium 4.3
Rapid7 Nexpose Forced Browsing
Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.
-
High 8.8
Apache UIMA DUCC: DUCC (EOL) allows RCE
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA,…
-
High 7.5
Information disclosure in Vira-Investing
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting. This issue affects Vira-Investing: before 1.0.84.86.
-
Medium 6.1
XSS in Vira-Investing
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS). This issue affects Vira-Investing: before 1.0.84.86.
-
Medium 5.3
angular vulnerable to regular expression denial of service via the angular.copy() utility
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large careful…
-
Medium 5.3
angular vulnerable to regular expression denial of service via the <input type="url"> element
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is p…
-
Medium 5.3
angular vulnerable to regular expression denial of service via the $resource service
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted inpu…
-
Medium 6.5
Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not s…
-
Medium 6.5
Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or…
-
Medium 5.0
Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side chann…
-
Critical 9.8
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server…
-
High 7.8
A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client e…
-
Critical 9.1
Use of Hard-coded, Security-relevant Constants in deepset-ai/haystack
Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.
-
High 7.8
A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could u…
-
High 7.8
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects vers…
-
Critical 9.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…
-
Medium 5.9
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in …
-
High 7.7
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…
-
Medium 5.9
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…
-
Unscored —
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing wa…
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…