Archive
21 April 2023
Vulnerabilities first published on this day (UTC), newest first.
40 results · Clear filters · Feed
-
Medium 6.5
Cross site request forgery token fixation in fastify-passport
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be b…
-
Medium 4.3
Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticate…
-
Medium 5.3
Improper Input Validation in nyholm/psr7
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### P…
-
Medium 5.3
Improper header validation in httpsoft/http-message
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### P…
-
Medium 5.4
Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code.
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 6.3
SourceCodester Task Reminder System manage_user.php sql injection
A vulnerability has been found in SourceCodester Task Reminder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can b…
-
Medium 6.3
SourceCodester Task Reminder System manage_reminder.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Task Reminder System 1.0. This affects an unknown part of the file /admin/reminders/manage_reminder.php. The manipulation of the argument id leads to sql injection. It is possible …
-
Medium 6.3CVE-2023-2215 Public exploit
Campcodes Coffee Shop POS System manage_user.php sql injection
A vulnerability classified as critical has been found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the at…
-
Medium 6.3
Campcodes Coffee Shop POS System manage_sale.php sql injection
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/sales/manage_sale.php. The manipulation of the argument id leads to sql injection. The attack may b…
-
Medium 6.3
Campcodes Coffee Shop POS System manage_product.php sql injection
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/products/manage_product.php. The manipulation of the argument id leads to sql injection. The attack…
-
Medium 6.3
Campcodes Coffee Shop POS System view_product.php sql injection
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/products/view_product.php. The manipulation of the argument id leads to sql injection. It is possible to ini…
-
Medium 6.3
Campcodes Coffee Shop POS System manage_category.php sql injection
A vulnerability was found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. T…
-
Medium 6.3
Campcodes Coffee Shop POS System view_category.php sql injection
A vulnerability has been found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/categories/view_category.php. The manipulation of the argument id leads to sql inj…
-
Medium 6.3
Campcodes Coffee Shop POS System view_details.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/sales/view_details.php. The manipulation of the argument id leads to sql injection. It is possible to laun…
-
Medium 6.3
Campcodes Retro Basketball Shoes Online Store details.php sql injection
A vulnerability, which was classified as critical, has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file details.php. The manipulation of the argument id leads to sql injection. The attack …
-
Medium 6.3
Campcodes Retro Basketball Shoes Online Store contactus1.php sql injection
A vulnerability classified as critical was found in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file contactus1.php. The manipulation of the argument email leads to sql injection. The attack can be initiat…
-
Medium 6.3
Campcodes Retro Basketball Shoes Online Store contactus.php sql injection
A vulnerability classified as critical has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file contactus.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the a…
-
Medium 6.3
Campcodes Retro Basketball Shoes Online Store login.php sql injection
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument email leads to sql injection.…
-
Medium 6.3
Campcodes Retro Basketball Shoes Online Store faqs.php sql injection
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file faqs.php. The manipulation of the argument id leads to sql injection. The …
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /gof…
-
Medium 5.5
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /gof…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /go…
-
Medium 4.9
H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /gof…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /gof…
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.
-
Medium 4.9
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.
-
Medium 4.6
Improper Access Control in francoisjacquet/rosariosis
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
-
Medium 6.8
Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
-
Medium 6.1
In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could…
-
Medium 6.1CVE-2022-48150 Public exploit
Shopware vulnerable to cross-site scripting (XSS)
Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
-
Medium 6.8
IO FinNet tss-lib vulnerable to replay attacks involving proofs
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemente…
-
Medium 6.1
SolarWinds Platform Incorrect Input Neutralization Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.