Archive
19 April 2023
Vulnerabilities first published on this day (UTC), newest first.
94 results · Feed
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
-
Medium 5.5
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
-
High 7.5
Insecure Random Generation in Netflix Lemur
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
-
High 7.8
A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an…
-
Medium 5.8
Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue w…
-
Medium 6.5
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the resto…
-
Medium 6.5
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quara…
-
High 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page in pay
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails appl…
-
Medium 4.0
Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor
Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud …
-
Medium 4.3
Reaction metadata exposed in private topics in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed …
-
Medium 5.5
AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token…
-
High 7.5
Stargate-Bukkit improperly handles vehicles causing data duplication.
Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items when teleporting through a portal; when they reappear, they will still have their items impacting t…
-
Low 2.9
FTP Agent forwards traffic on inactive ports to LinkManager
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
-
Medium 4.9
GateManager debug interface is included in non-debug builds
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.
-
Medium 6.1
Clear-text passwords in configuration files
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
-
Medium 5.5
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at…
-
Medium 5.5
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at…
-
Medium 5.5
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…
-
Medium 6.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service…
-
High 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service…
-
High 8.8
Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploi…
-
High 7.5
Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to e…
-
Critical 9.6CVE-2023-2136 Exploited
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the ren…
KEV Apr 21, 2023 -
High 8.8
Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to…
-
High 8.8
Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to…
-
Medium 5.5
A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux K…
-
Medium 5.5
Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with…
-
Medium 5.5
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…
-
High 7.8
A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a mal…
-
Medium 5.5
A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack V…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Medium 5.3
PowerJob Incorrect Access Control vulnerability
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
-
Medium 5.5
Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This…
-
Medium 5.3
PowerJob vulnerable to Incorrect Access Control via the create user/save interface.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
-
Medium 5.3
PowerJob vulnerable to Insecure Permissions
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
-
Medium 5.4
Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute ar…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in /index.php?page=category_list of Online Jewelry Shop v1.0 allows a…
-
Medium 5.5
A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…
-
Medium 5.5
A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…
-
High 7.5
Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow…