Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
2,434 results · Feed
-
High 8.2
IBM QRadar WinCollect Agent privilege escalation
IBM QRadar WinCollect Agent 10.0 through 10.1.3 could allow a local authenticated attacker to gain elevated privileges on the system. IBM X-Force ID: 248158.
-
Medium 4.3
meitar Inline Google Spreadsheet Viewer Plugin inline-gdocs-viewer.php displayShortcode cross-site request forgery
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-si…
-
High 7.8
IBM QRadar WinCollect Agent privilege escalation
IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a local user to execute commands on the system due to execution with unnecessary privileges. IBM X-Force ID: 248156.
-
High 8.7
Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface
Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document n…
-
Medium 6.5
Windows Local Security Authority (LSA) Denial of Service Vulnerability
Windows Local Security Authority (LSA) Denial of Service Vulnerability
-
Medium 5.5
Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
-
High 7.8CVE-2022-35756 EPSS 11%
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 7.3
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
-
Medium 6.7
Unified Write Filter Elevation of Privilege Vulnerability
Unified Write Filter Elevation of Privilege Vulnerability
-
High 7.3
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.8
Windows Digital Media Receiver Elevation of Privilege Vulnerability
Windows Digital Media Receiver Elevation of Privilege Vulnerability
-
High 7.5CVE-2022-35748 EPSS 47%
HTTP.sys Denial of Service Vulnerability
HTTP.sys Denial of Service Vulnerability
-
Medium 5.9
Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
-
High 7.8
Windows Digital Media Receiver Elevation of Privilege Vulnerability
Windows Digital Media Receiver Elevation of Privilege Vulnerability
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
-
High 7.8
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
-
Critical 9.8
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
-
Medium 6.5
gpt_academic's Configuration File vulnerable to File Information Disclosure
gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to infor…
-
Medium 6.1
Formcreator vulnerable to stored XSS from ##FULLFORM##
Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FUL…
-
High 8.3
EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking
EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0.
-
High 8.6
Deno missing "--allow-net" permission check for built-in Node modules
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`).…
-
High 8.6
mx-chain-go does not treat invalid transaction with wrong username correctly
mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly …
-
Medium 6.3
SourceCodester Lost and Found Information System access control
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can…
-
Low 2.4
SourceCodester Lost and Found Information System Manage User Page cross site scripting
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument…
-
Low 3.7
Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service
A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time.
-
Low 3.5
yiwent Vip Video Analysis admincore.php cross site scripting
A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely…
-
Medium 6.3
yiwent Vip Video Analysis title.php server-side request forgery
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. Th…
-
Low 3.5
BeipyVideoResolution admincore.php cross site scripting
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. T…
-
Unscored —
This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block setti…
-
Unscored —
This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when r…
-
Unscored —
The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue,…
-
Unscored —
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, …
-
Medium 4.6
In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible
-
Medium 5.3
In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive accoun…
-
Medium 4.6CVE-2023-34225 EPSS 61%
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible