Archive
26 April 2023
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
-
Medium 5.5
CVE-2022-45876
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 6.5
HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
-
Medium 5.3
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196.
-
Medium 6.0
Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of…
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 5.4
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE: > A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript executi…
-
Medium 5.4
Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author…
-
Medium 4.3
Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author …
-
Medium 4.2
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced t…
-
Medium 5.8
Rapid7 Insight Agent Directory Traversal
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerab…
-
Medium 6.1
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attac…
-
Medium 6.1
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
-
Medium 4.9
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, an…
-
Medium 6.5
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security relea…
-
Medium 4.7
Cross-Site Request Forgery (CSRF) in builderio/qwik
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
-
Medium 6.5
CLTPHP <=6.0 is vulnerable to Directory Traversal.
-
Medium 6.1
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
-
Medium 6.1CVE-2023-30210 Scanner template
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
-
Medium 6.1
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML …
-
Medium 5.4
Access bypass in Drupal core
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but w…
-
Medium 6.1
Lack of domain validation in Druple core
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulner…
-
Medium 6.5
Access bypass in Drupal Core
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added…