Archive
21 April 2023
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
Critical 9.8
OS command injection in Gipsy
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The `!ping` command when provided with an IP or hostname used to run a ba…
-
Critical 9.8
MAXTECH MAX-G866ac Remote Management missing authentication
A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack re…
-
Critical 9.8
PowerJob vulnerable to incorrect access control
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
-
Critical 9.1
Improper Authorization in modoboa/modoboa
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
-
Critical 9.1
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication
io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/ke…