Archive
10 May 2023
Vulnerabilities first published on this day (UTC), newest first.
132 results · Clear filters · Feed
-
Medium 5.1
Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices
Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vul…
-
Medium 5.4
Ibexa User Settings are accessible on the front-end for anonymous user
### Impact This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and ha…
-
Medium 4.1
Improper Limitation of a Pathname to a Restricted Directory
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders i…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.8
Improper Input Validation in Web Interface
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to arbitrarily alter the content of a configuration file. See SEL Servic…
-
Medium 5.9
Improper Input Validation in Web Interface
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects. See…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.4
Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices
An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Ho…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.3
Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and…
-
Medium 4.0
Authentication Bypass Using an Alternate Path or Channel
An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more deta…
-
Medium 4.7
Improper Certificate Validation
An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote unauthenticated attacker to conduct a man-in-the-middle (MitM) attack. See SEL Service Bu…
-
Medium 6.8
Channel Accessible by Non-Endpoint
A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELE…
-
Medium 5.5
in-toto vulnerable to Configuration Read From Local Directory
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In…
-
Medium 4.4
PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
-
Medium 6.5
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administra…
-
Medium 6.5
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC…
-
Medium 6.5
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC…
-
Medium 5.0
Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may …
-
Medium 6.7
Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow a…
-
Medium 4.4
Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to p…
-
Medium 5.0
Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authentic…
-
Medium 5.0
Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 softw…
-
Medium 6.7
Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may …
-
Medium 6.7
Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authent…
-
Medium 5.0
Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potential…
-
Medium 5.0
Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable …
-
Medium 6.7
Incorrect default permissions in the software installer for Intel(R) Unite(R) Client software for Windows before versio…
-
Medium 4.2
Uncontrolled search path in the Intel(R) MacCPUID software before version 3.2 may allow an authenticated user to potent…
-
Medium 6.7
Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.…
-
Medium 4.8
Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated us…
-
Medium 5.0
Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authen…
-
Medium 6.7
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user t…